Splunk Add-on for Microsoft Security -Threat Intelligence datasets

[norbertt911]

Hello,

Is there anybody who set this input? I have the ThreatIntelligence.Read.All permission missing error during the input configuration. This permission is already added to the app on the Azure side. (MS Graph permission).

The documentation says nothing... (all other inputs are ok)

Thanks, 
Norbert

[tscroggins]

Hi @norbertt911,

Absent more information, verify admin consent has been granted for your application. See https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent for more information.

[norbertt911]

Hello, 

Admin consent is already there...

But I think I figured out...

First of all it will not work with the https://graph.microsoft.com/v1.0/security.... endpionts, just with https://graph.microsoft.com/beta/security.... 

Second (and this is the issue in my case): it needs a Microsoft Defender Threat Intelligence license (MDTI add-on subscription) for the tenant.

[New_splunkie]

Hi @norbertt911 ,

How did you fixed this, I have the same issue. 

How and where did you configured the beta api permission?

Thanks in advance.

[norbertt911]

Hi,

I have no chance to fix it because we don't have the Microsoft Defender Threat Intelligence license (MDTI add-on subscription) ...

[New_splunkie]

Hi,

Thanks for the reply.

Although I have the MDTI license but it still doesn't work. Assigned the necessary permission, but no success.

Might need to look for some other integration method/add-on this defender intel

[norbertt911]

In that time, MS API documentation referred to the beta Graph API endpoint, since that seems the "normal" v1.0 endpoint seems to be capable of providing TI information. 

https://learn.microsoft.com/en-us/graph/api/resources/security-threatintelligence-overview?view=grap...

... from here it's really a bug hunt. Try to connect and fetch something with curl. If it works, then check the Python script in the Splunk App... or diy yours 🙂