Splunk Add-on for Microsoft Office 365 v4.6.0: Management Activity Inputs Failing After Upgrade Due to Corrupted Checkpoint

Applicability

Description

The error occurs when the checkpoint for "cloudappsecuritytoken" becomes corrupted or misconfigured, leading to a failure in decrypting credentials.

The specific error "KeyError: 'cloudappsecuritytoken'" highlights an issue with the token in the tenant configuration.

Although the token is not required for Management Activity inputs, its corruption interferes with the authentication process and results in failed data collection.

Investigation

Use the following SPL query to identify errors in internal logs:

index=_internal *O365* log_level=ERROR

Error Logs:

12-09-2024 18:53:23.477 +0000 ERROR AdminManagerExternal [1241679 TcpChannelThread] - Stack trace from python handler:\nTraceback (most recent call last):\n...  KeyError: 'cloudappsecuritytoken'

The error indicates a corrupted or missing "cloudappsecuritytoken" checkpoint, which disrupts the decryption process for credentials.

This issue arises during API authentication for Management Activity data collection, often following an upgrade.

Resolution

To resolve the issue, follow these steps:

1. Remove the CloudAppSecurity Token:
   Navigate to the configuration page of the Splunk Add-on for Microsoft Office 365.
   Locate and remove the "cloudappsecuritytoken" checkpoint from the tenant configuration.
   Since this token is not required for Management Activity inputs, removing it will not affect functionality.
   
   
2. Re-enter the Client Secret:
   Update the tenant's client secret in the configuration to ensure valid authentication credentials.
   Save the changes to refresh the authentication setup.
   
   
3. Re-enable Inputs:
   Disable the Management Activity inputs temporarily.
   Re-enable them to refresh their configurations and re-establish data collection.
   
   
4. Verify Data Collection:
   Use the following SPL query to confirm that data ingestion has resumed successfully:
   

   index=your_index_name sourcetype="o365:management_activity"

By removing the unnecessary token and refreshing the client secret, the Splunk Add-on for Microsoft Office 365 should resume proper data collection without further errors.

Related Links

Management Activity input creation documentation