topic Re: Microsoft Azure Active Directory Add-on for Splunk - Azure AD Group Data in All Apps and Add-ons

Microsoft Azure Active Directory Add-on for Splunk - Azure AD Group Data

splunkmachine — Wed, 12 Jun 2019 12:24:37 GMT

I've installed version Version 1.2.1 (June 10, 2019) of Microsoft Azure Active Directory Add-on for Splunk and can now obtain the Azure AD User data.

Is it possible to make a modification to the TA to collect the group data from Azure AD via a rest api to collect from microsoft graph.

Re: Microsoft Azure Active Directory Add-on for Splunk - Azure AD Group Data

splunkmachine — Wed, 30 Sep 2020 00:58:45 GMT

I believe it would require a new import module writing - input_module_MS_AAD_group.py

    url = "https://graph.microsoft.com/v1.0/groups?$expand=members"

Re: Microsoft Azure Active Directory Add-on for Splunk - Azure AD Group Data

Dworsnop — Mon, 16 Sep 2019 10:58:26 GMT

Hi, do you have any further details of the python script you mention? As far as I can see it doesn't already exist within the Azure AD TA.

Has anyone else done this?

Thanks in advance.

Re: Microsoft Azure Active Directory Add-on for Splunk - Azure AD Group Data

bmarrable — Wed, 24 Mar 2021 09:26:49 GMT

Has anything progressed on this subject, I'm very keen to get Microsoft Group Membership information into Splunk, either as an additional field in the azure:aad:user sourcetype or as a seperate input as azure:aad:group. This would be useful to prioritise and categorise users in Enterprise Security's Identity Framework