Getting Data In

Has anyone indexed Azure Devops audit log?

las
Contributor

Hi.

It seems Microsoft has exposed the audit log for Azure DevOps, https://docs.microsoft.com/en-us/rest/api/azure/devops/audit/audit%20log/query?view=azure-devops-res...
Has anyone tried to index this log and how did you do it?

Kind regards
las

Tags (2)
0 Karma

jscraig2006
Communicator

Hi Ias,
Yes, you will need a PAT created in Azure Devops and use a Python script for the scripted input.

personal_access_token = '<access_token>'
organization_url = 'https://<azure_devops_url>/_apis/audit/auditlog?api-version=5.1-preview.1'
json_data = requests.get(organization_url, auth=('', personal_access_token)).json()

las
Contributor

Thank you for your answer, I was just curious if anybody had done it, and if it was done, if they found an add-on or created either a scripted- or modular-input

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...