Splunk Add-on for Microsoft Cloud Services: How to receive sign-in and audit log data

[ptur]

Hello,

We have recently installed this Azure add-on. I can successfully receive data from O365 Management APIs, Azure resources ....however, the only data we really need is data that can be accessed from Azure portal by going to Azure Active Directory -> Activity -> Sign-ins and Audit Logs

Have anyone had any success pulling in this data?

Thanks!

[jconger]

The Azure AD sign-in and audit data can be access with this add-on -> https://splunkbase.splunk.com/app/3757/

Here is what the add-on collects:

Sign-in data
- Application targeted for sign-in
- Date/time of the sign-in
- Status of login (success/fail)
- Failure reason if applicable
- User
- Geo data like coordinates, city, state, zip

Audit activity data
- Activity
- Actor (ip address, user name)
- Targets (what was changed including old and new values)
- Tenant details