Proofpoint on Demand customers can use this add-on to collect email security logs that can be stored and indexed in Splunk to search, report and investigate email delivery. This technology add-on maps the message and mail logs to Splunk Common Information Model (CIM) for email.

Because Azure and Office 365 are widely used, I decided to start with this. I hope you will find it useful because unfortunately, there is a lack of good resources other than Microsoft when it comes to monitoring Azure with a SIEM and I had to spend many hours to study the logs and figure out what was relevant.