All Apps and Add-ons

Splunk Add-on for Microsoft Cloud Services: How to receive sign-in and audit log data

ptur
Path Finder

Hello,

We have recently installed this Azure add-on. I can successfully receive data from O365 Management APIs, Azure resources ....however, the only data we really need is data that can be accessed from Azure portal by going to Azure Active Directory -> Activity -> Sign-ins and Audit Logs

Have anyone had any success pulling in this data?

Thanks!

jconger
Splunk Employee
Splunk Employee

The Azure AD sign-in and audit data can be access with this add-on -> https://splunkbase.splunk.com/app/3757/

Here is what the add-on collects:

Sign-in data
- Application targeted for sign-in
- Date/time of the sign-in
- Status of login (success/fail)
- Failure reason if applicable
- User
- Geo data like coordinates, city, state, zip

Audit activity data
- Activity
- Actor (ip address, user name)
- Targets (what was changed including old and new values)
- Tenant details

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...