topic Re: How can we ingest MDI logs to Splunk? in Deployment Architecture

How can we ingest MDI logs to Splunk?

RishavAnand — Mon, 01 Apr 2024 05:36:54 GMT

How can we ingest MDI logs to Splunk?

Re: How can we ingest MDI logs to Splunk?

ITWhisperer — Mon, 01 Apr 2024 07:12:05 GMT

What are MDI logs?

Where are they stored?

Do you have Splunk forwarders on there too?

There are a lot of unanswered questions about your environment and the potential ways that data can be ingested into Splunk. Have you ingested other data sources?

Can you modify these to include the MDI logs?

Re: How can we ingest MDI logs to Splunk?

RishavAnand — Mon, 01 Apr 2024 07:15:13 GMT

"Splunk forwarders" are installed on the servers where MDI sensor is installed.

So far, no ingestion has been done.

Re: How can we ingest MDI logs to Splunk?

ITWhisperer — Mon, 01 Apr 2024 07:19:37 GMT

So, you need to configure the inputs for the forwarders so that they know where to look for the MDI logs

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Admin/IntroGDI

Re: How can we ingest MDI logs to Splunk?

RishavAnand — Mon, 01 Apr 2024 07:24:12 GMT

MDI logs are generated on security.microsoft.com portal and are not present locally on the servers where Splunk forwarders and MDI sensor are installed. There is a possibility with Sentinel [ https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration ] but we want to do this to Splunk.

We might not be able to install anything on the portal. Do we have a set of documentation available as to how to send the MDI logs from security.microsoft.com portal to Splunk ?

Re: How can we ingest MDI logs to Splunk?

jconger — Fri, 05 Apr 2024 15:36:45 GMT

To get Microsoft Defender XDR data into Splunk, use the Splunk Add-on for Microsoft Security => https://splunkbase.splunk.com/app/6207

All the Microsft Defender XDR incidents, alerts, entities, evidence, etc. are collected by this add-on.

Re: How can we ingest MDI logs to Splunk?

dsctm3 — Fri, 05 Apr 2024 19:16:38 GMT

If you are trying to find the alerts coming from Microsoft Defender for Identity, you can gather the alerts via the MS Graph Plugin found here:

https://splunkbase.splunk.com/app/4564#Configuring-Microsoft-Graph-Security-data-inputs