Splunk Add-on for Microsoft Security -Threat Intelligence datasets

[norbertt911]

Hello,

Is there anybody who set this input? I have the ThreatIntelligence.Read.All permission missing error during the input configuration. This permission is already added to the app on the Azure side. (MS Graph permission).

The documentation says nothing... (all other inputs are ok)

Thanks, 
Norbert

[tscroggins]

Hi @norbertt911,

Absent more information, verify admin consent has been granted for your application. See https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent for more information.

[norbertt911]

Hello, 

Admin consent is already there...

But I think I figured out...

First of all it will not work with the https://graph.microsoft.com/v1.0/security.... endpionts, just with https://graph.microsoft.com/beta/security.... 

Second (and this is the issue in my case): it needs a Microsoft Defender Threat Intelligence license (MDTI add-on subscription) for the tenant.