Getting Data In

Splunk Add on for Microsoft Azure Secure Score- How to resolve this error?

paulmachin
New Member

Hi, 

I am working with the Splunk Add on for Microsoft Azure and im trying to get the Secure Score working with it, has anyone had any luck with getting it working? 

At the moment it looks like I need to do it s the input being a resource graph, but it doesn't seem to be pulling that data through. It has been set up with the reader IAM role for the correct subscription (as suggested by their documentation) 

The error I seem to be getting in splunk is as follows: 

 

 

File "/opt/splunk/etc/apps/TA-MS-AAD/lib/requests/models.py", line 1021, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 400 Client Error: Bad Request for url: https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01

 

 

Any help or advice would be appreciated. 

Labels (3)
Tags (2)
0 Karma

hansmmaldonado
Observer

the format of the query is the problem. A simple way to populate the query is to reference a table from the Resource Graph table here...

https://learn.microsoft.com/en-us/azure/governance/resource-graph/concepts/query-language#resource-g...

For example, "ServiceHealthResources" works, as does "SecurityResources".

0 Karma

hansmmaldonado
Observer

Did you ever resolve this @paulmachin ? I am facing identical error.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...