https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450568#M55437 <P>Hi @sylbaea ,<BR /> How can I get data from Syslog server into splunk? Can you please help me ..</P> Tue, 12 Feb 2019 10:34:23 GMT ips_mandar 2019-02-12T10:34:23Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450565#M55434 <P>Hi <BR /> I want to integrate Microsoft Cloud app security with Splunk, is there any add-on available?<BR /> Which fields are required to integrate with Splunk and how?<BR /> Thanks,</P> Mon, 11 Feb 2019 06:11:37 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450565#M55434 ips_mandar 2019-02-11T06:11:37Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450566#M55435 <P>Hello,</P> <P>MS Cloud App security does provide a syslog-based export method:<BR /> - as an MS Cloud App admin, you can generate required setup to install an on-premise agent (Java-based) that will periodically download Cloud App security events and then forward to the specified syslog server<BR /> - from there, you need to implement custom knowledge object to leverage syslog events... As far as I know, there is currently no TA you can leverage for that</P> <P>Regards.</P> Mon, 11 Feb 2019 06:20:40 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450566#M55435 sylbaea 2019-02-11T06:20:40Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450567#M55436 <P>Thanks @sylbaea </P> Mon, 11 Feb 2019 11:50:23 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450567#M55436 ips_mandar 2019-02-11T11:50:23Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450568#M55437 <P>Hi @sylbaea ,<BR /> How can I get data from Syslog server into splunk? Can you please help me ..</P> Tue, 12 Feb 2019 10:34:23 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450568#M55437 ips_mandar 2019-02-12T10:34:23Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450569#M55438 <P>this is a very wide topic... you can either setup Splunk as a syslog server (not recommend if you do have a lot of traffic) either you can index the data of a dedicated syslog server. There is not universal solution, it depends on your needs and environment.</P> <P>You can search here, it has already been discussed a lot:<BR /> <A href="https://answers.splunk.com/answers/75667/splunk-as-a-syslog-server.html">https://answers.splunk.com/answers/75667/splunk-as-a-syslog-server.html</A><BR /> <A href="https://answers.splunk.com/answers/28680/universal-forwarder-vs-dedicated-rsyslog-syslog-ng-servers-to-forward-syslog-to-splunk-indexer.html">https://answers.splunk.com/answers/28680/universal-forwarder-vs-dedicated-rsyslog-syslog-ng-servers-to-forward-syslog-to-splunk-indexer.html</A></P> Tue, 12 Feb 2019 10:38:20 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450569#M55438 sylbaea 2019-02-12T10:38:20Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450570#M55439 <P>This guidance is currently your best/easiest method for accomplishing what you have outlined (no current App or TA available):<BR /> <A href="https://docs.microsoft.com/en-us/cloud-app-security/siem">https://docs.microsoft.com/en-us/cloud-app-security/siem</A></P> Tue, 04 Jun 2019 19:24:39 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/450570#M55439 s207307 2019-06-04T19:24:39Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/528496#M64136 <P>Since October 2020 there is add-on available for this matter:</P><P><A title="Microsoft Cloud App Security Add-on for Splunk" href="https://splunkbase.splunk.com/app/5278/" target="_blank" rel="noopener">Microsoft Cloud App Security Add-on for Splunk</A></P> Mon, 09 Nov 2020 08:58:26 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-integrate-Microsoft-Cloud-App-security-with-Splunk/m-p/528496#M64136 MaverickT 2020-11-09T08:58:26Z