We want to use the Splunk Add-on for Microsoft Cloud Services for the ingestion of data from the Azure Active Directory. For this we send data from our LogAnalyticsWorkspace (and an EventHub) to the Splunk TA (which is working). Unfortunately, the documentation is not very precise about the source types to use.
Which source types can I use for the following data?
- Sign-ins (azure:monitor:aad ?)
- Audit data (azure:monitor:aad ?)
- AAD Risky Users
- User Risk Events?
Thanks.
