Risky Signin and Risky user from Azure Identity protection to Splunk

[penieldaniel]

I would like to ingest "Risky Sign-in" and "Risky User" events from Azure Entra Identity Protection into Splunk.

I have tried the following options but was unsuccessful:

1. Splunk Add-on for Microsoft Azure – This add-on is no longer maintained or supported by Splunk.

2. Azure Function App to Splunk HEC – Although this approach seems simpler and more cost-effective, I encountered several challenges during implementation.

I’m still open to using the second option since it involves minimal cost, but it would be helpful if there is a standard or recommended procedure available for this integration.

[shashankD]

You can also use the add-on Splunk Add-on for Microsoft Cloud Services

[penieldaniel]

Thanks, i tried this but I could not find "Microsoft Graph" as input if i use this Add-on. how can i send the pull request to the graph API ?
which other input can i use, please

[VatsalJagani · Accepted solution]

@penieldaniel - I think you can still use this Add-on - https://splunkbase.splunk.com/app/3757

* This Add-on is not supported means, this is not part of Splunk support, but you can still use the Add-on.

Input Microsoft Entra ID Risk Detection

Microsoft Graph

Permissions (Application) IdentityRiskEvent.Read.All - Read all identity risk event information (Application) IdentityRiskyUser.Read.All - Read all identity risk user information

N/A

Sourcetypes azure:aad:identity_protection:risk_detection azure:aad:identity_protection:risky_user

I hope this helps!!! Kindly upvote if it does!!!

[penieldaniel]

Hi @VatsalJagani 

Thanks for your reply.