Splunk and Microsoft Advanced Threat Analytics

[alonsocaio]

Is there any way to integrate and send Microsoft Advanced Threat Analytics events to Splunk?

[25D55AD2]

But are these logs well parsed by default by Splunk?

[alonsocaio]

Yes, they are. I have created a custom sourcetype for MS ATA so I could extract more fields, but It is well parsed since It has field : value in its logs and also have some delimiters.

[alonsocaio · Accepted solution]

Actually I found a solution. Microsoft ATA can send Syslog alerts to any SIEM server.

[edhealea]

Where you able to get this to work? I have added my syslog server into the ATA config under the syslog server setting but I am not getting any alerts. I can generate a test message and receive it in our syslog server.

[alonsocaio]

I have configured Syslog Server Endpoint (server:port), Transport (UDP) and Format (RFC 5424), following the docs. Take a look at the Notifications menu and go to Syslog Notifications. Check if all options are enabled.