App details needed

[Vonphenyl]

Hi All,

Does the following app still works?. Has someone tested this app recently?.

Microsoft Sentinel Add-On for Splunk | Splunkbase

[Joe_Hartzel]

Interesting discussion! It looks like you're exploring the details of this Splunk app/add-on—perhaps review its structure, manifest, or resource files? If anyone wants to dig deeper into its inner workings, you could use an APK file editor like APKTool, JADX, or APK Editor Pro to unpack and inspect its components. It’s a handy way to audit how the app is built or modify its behavior.

[livehybrid]

Hi @Vonphenyl 

As this is an archived app its no longer in development so even if it currently does work, there is no guarantees on how long it would continue to do so.

I would checkout Splunk Add on for Microsoft Azure which supports pulling data using the Microsoft Security Graph API - this should be able to retrieve the sentinel data you need.

Are you looking to get your notable sentinel events into Splunk or something else?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Vonphenyl]

Hi ,

Thanks for sharing the details. I wanted to know if I want to migrate from Splunk to Azure sentinel. What capabilities does the Splunk Add on for Microsoft Azure | Splunkbase brings when you compare it with the older app i.e are there no parsing & normalization if I use this app ? Are there any limitations of the app Splunk Add on for Microsoft Azure | Splunkbase. Also what other steps one has to consider apart the Splunk addon for the migration to be successful from Splunk to Sentinel.

[PrewinThomas]

@Vonphenyl 

This Add-on is designed to bring Azure data into Splunk, not to format Splunk data for Sentinel.

Microsoft offers an automated SIEM migration experience for Splunk-to-Sentinel.
#https://learn.microsoft.com/en-us/azure/sentinel/siem-migration

There are few things to keep in mind,

-Parsing and normalization might not happen automatically when moving data from Splunk to Sentinel.

-Complex SPL queries usually need to be rewritten

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!