topic Re: Add-ons for microsoft products in Splunk Enterprise Security

Add-ons for microsoft products

Amire22 — Sun, 20 Jul 2025 08:30:39 GMT

I would appreciate help from anyone who has encountered a similar problem:

We are using Microsoft's E5 licensing with the following products:

Intune
Entra ID
Defender for endpoint
office 365
teams

All events from Microsoft are streamed to EventHub and from there to our Splunk ES

We are very confused and don't know which Add-Ons we should install.

I would love to hear from anyone who uses these technologies.

Re: Add-ons for microsoft products

kiran_panchavat — Sun, 20 Jul 2025 12:57:32 GMT

@Amire22

Hello, you can install the Splunk Add-on for Microsoft Cloud Services add-on to onboard the logs to Splunk. https://splunkbase.splunk.com/app/3110

https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_Microsoft_Azure_Event_Hub_data

https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/

Re: Add-ons for microsoft products

Amire22 — Sun, 20 Jul 2025 13:12:07 GMT

thank you

it will include logs from all my products above?

Re: Add-ons for microsoft products

PickleRick — Sun, 20 Jul 2025 18:00:09 GMT

Not necessarily.

There are separate addons for specific services (separate one for Teams, another for Security (Defender and Defender for endpoint) and so on). This one will cover getting data from Event Hub but you might need another addon to parse your data properly and map fields to CIM.

I'm not sure though if the fact that you're pushing the data through Event Hub won't mangle the events since some of those addons expect the inputs to run differently (Graph API?).

You need to go to Splunkbase, type in "microsoft" and check it out