topic Re: Which add-on for o365 and Azure log collection? in Getting Data In

Which add-on for o365 and Azure log collection?

ojay — Wed, 02 Feb 2022 09:06:51 GMT

Hi all,

I am planning on integrating o365 and Azure cloud services to my Splunk on-prem environment.

Now there are several Add-Ons to choose from in Splunkase

Microsoft Azure Add on for Splunk
Splunk Add-on for Microsoft Office 365
Splunk Add-on for Microsoft Cloud Services

What is the main difference between these Add-Ons and which should i use? The documentation did not really help.

"The Splunk Add-on for Microsoft Office 365 replaces the modular input for the Office 365 Management API within the Splunk Add-on for Microsoft Cloud Services."

Is it still possible to collect the o365 logs with the Cloud Services add-on which collects via so called event hubs?

Thank you,

Re: Which add-on for o365 and Azure log collection?

isoutamo — Wed, 02 Feb 2022 22:05:58 GMT

we have used this instructions

https://www.ciraltos.com/use-splunk-to-collect-logs-from-office-365-and-azure-ad/ to setup M365 data collection and presentation. This guide is little bit outdated, but you could manage configuration with small modifications.

r. Ismo

Re: Which add-on for o365 and Azure log collection?

ojay — Fri, 04 Feb 2022 07:59:07 GMT

Thank you for the quick feedback, the guide is helpful but i was more looking into a comparison about what add-on to use.

Is the "Splunk Add-on for Microsoft Cloud Services" able to get the O365 data? Is it advised to use it?

Re: Which add-on for o365 and Azure log collection?

ojay — Fri, 04 Feb 2022 08:12:36 GMT

In case i use both add-on's do I need to create two seperate application integrations?