Getting Data In

Indexing and parsing Azure AD logs

vrajshekar
Path Finder

I am new to splunk, we are currently trying to configure Splunk to parse AzureAD logs being received from a Syslog server.

I have installed multiple apps/add-ons, but none of them are helping me parse the logs.

I have configured inputs.conf, and when I set the sourcetype from Add-on, it doesn't work.

How can I achieve this. please help

 

 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @vrajshekar 

You are not using the Add-on to pull the logs from MS API as described in docs, If you are getting them from syslog server then are you storing them on files (or) directly trying to forward to Splunk HF/indexer?

if you are storing syslog on files and forwarding them via UF then you have to set-up  inputs.conf and use the sourcetype=o365:management:activity

You need to find props.conf inside add-on having sourcetype - [o365:management:activity] and copy the props file to the Heavy Forwarder/Indexer depends on your set-up either to location /opt/splunk/system/local or /opt/splunk/etc/apps/<yourapp>/local/, then restart the HF/indexer. 

This is a general stuff most of the Splunkers follow, you have to improvise depends on your set-up. The above process works for parsing only.

--------------------

An upvote would be appreciated if it helps!

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @vrajshekar 

As per docs 'Splunk Add-on for Microsoft Office 365' is the right add-on to pull the logs from MS API. Since you are using syslog as intermediate to send the logs to Splunk, you shall check what's the change in log structure if there is a change (usually syslog messages having additional headers added) you shall write your own parsing during index time.

On search head you shall write your own field extractions,   Splunk Documentation has list of sourcetypes - 'o365:management:activity' is the one where AD Audit logs being logged if you install add-on correctly (since you have syslog server not sure will this really work in your case).

Splunk docs always the first source of info Installation and configuration overview for the Splunk Add-on for Microsoft Office 365 - Splunk Docu...

----------------------------

An upvote would be appreciated if it helps!

Tags (2)
0 Karma

vrajshekar
Path Finder

HI @venkatasri

 

No additional fields being add from Syslog.

Can I configure the inputs.conf to use sourcetype from 'Splunk Add-on for Microsoft Office 365',  is this possible?

If not, please let me know if you have any suggestions.

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...