topic Re: Getting Microsoft Teams Data into Splunk in Getting Data In

Getting Microsoft Teams Data into Splunk?

tomapatan — Tue, 21 Feb 2023 15:05:05 GMT

Hi,

I`m following this article in an attempt to ingest Teams data into Splunk and I need some help with testing the webhook - can someone confirm what the webhook URL is ?

curl WEBHOOK_ADDRESS -d '{"value": "test"}'

Also, looking at the documentation for the Teams Add-on for Splunk it states that "theTeams Webhook is not available for Splunk Cloud installations." - has anyone found an alternative solution for Cloud Deployments ?

We use Splunk in a hybrid (cloud + on prem) environment.

Many thanks.

Re: Getting Microsoft Teams Data into Splunk

PaulPanther — Fri, 17 Feb 2023 12:47:04 GMT

You must provide the webhook address that you wanna call from Microsoft Teams. How you do the configuration on Microsoft Teams is described here: Create and add an outgoing webhook in Teams - Microsoft Support

Regarding Splunk Cloud the documentation recommends Azure Function as an alternative:

Note: The Teams Webhook is not available for Splunk Cloud installations. Consider Azure Functions as an alternative.

Microsoft Teams Add-on for Splunk | Splunkbase

Re: Getting Microsoft Teams Data into Splunk

tomapatan — Fri, 17 Feb 2023 12:57:38 GMT

Thanks Paul,

The Microsoft Teams Add-on for Spunk includes a Microsoft Teams-specific webhook that I`ve configured, but the documentation (link above) does not include the webhook URL for me to test., which is what I`m after.

Re: Getting Microsoft Teams Data into Splunk

PaulPanther — Fri, 17 Feb 2023 13:04:42 GMT

Okay, so you've already defined a webhook address that is pointing directly to your data collection node or any load balancer, reverse proxy, or tunnel in front.

Then replace the WEBHOOK_ADDRESS placeholder with your defined webhook address and execute the curl command.

The test is successful if your test event is searchable with

sourcetype="m365:webhook"

Re: Getting Microsoft Teams Data into Splunk

tomapatan — Fri, 17 Feb 2023 13:10:58 GMT

Hi Paul,

Unfortunately I didn`t get that far - when I created a new input in Splunk - add Teams Webhook, there`s no option to specify the URL, as per the screenshot attached. So I`m not sure where/how the webhook needs to be defined.

Re: Getting Microsoft Teams Data into Splunk

PaulPanther — Fri, 17 Feb 2023 13:17:34 GMT

Ahh, got it. You have to define 3 different Inputs :

1. Create a Teams Webhook input

2. Create a Teams Subscription input

3. Create a Teams Call Record input

As described in the details of Microsoft Teams Add-on for Splunk | Splunkbase.

In the Subscription input you can define the Webhook URL.

Re: Getting Microsoft Teams Data into Splunk

tomapatan — Mon, 20 Feb 2023 11:46:48 GMT

The following article answered all my questions:

https://community.splunk.com/t5/All-Apps-and-Add-ons/Ingesting-logs-from-Microsoft-Teams/m-p/506702

Thanks.