Splunk Add-on for Microsoft Cloud Services: Can Azure AD Identity Protection Risk events be ingested?

[jwalzerpitt]

Does the Splunk Add-on for Microsoft Cloud Services support ingesting Azure AD Identity Protection Risk events?

Thx

[jconger · Accepted solution]

The Splunk Add-on for Microsoft Cloud Services does not currently integrate with the Azure AD Identity Protection graph API (https://docs.microsoft.com/en-us/azure/active-directory/active-directory-identityprotection-graph-ge... ) You can use the Splunk Add-on builder to interface with this API to pull these events though.

[jwalzerpitt]

Thx for the reply and information