topic Re: Azure defender advanced hunting to Splunk SPL in Splunk Search

Azure defender advanced hunting to Splunk SPL

heskez — Thu, 06 Jun 2024 12:57:50 GMT

I am having an issue in Advanced hunting for Defender app in Splunk https://splunkbase.splunk.com/app/5518 My original KQL query in azure contains | JOIN KIND INNER. Is such syntax also possible in SPL?

Re: Azure defender advanced hunting to Splunk SPL

richgalloway — Thu, 06 Jun 2024 14:37:20 GMT

Yes, SPL has a join command, but it should be avoided because it doesn't perform well. See https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Join

Re: Azure defender advanced hunting to Splunk SPL

heskez — Fri, 07 Jun 2024 12:56:04 GMT

Thanks for your answer. I'm not sure if this is what I want. Because the advanced hunting app requires an API call with a limit of calls, I start doing a call on DeviceProcessEvents. Then I'm not sure if I need to do another API call on DeviceRegistryEvents, since I'd like to joint these two instances.

Re: Azure defender advanced hunting to Splunk SPL

heskez — Fri, 07 Jun 2024 13:15:05 GMT

So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt