Getting Data In

Why Splunk MS cloud add-on eventhub lost some security events from Defender for Cloud?

aasabatini
Motivator

Hi All,

I configured the MS add-on from a eventhub to gettin in splunk all security alert from Defender for cloud.

seems  splunk can't collect some alerts I don't understand why.

The eventhub is properly configured because I see all the logs from the eventhub also I see some security alerts but not all.

the only thing give me a suspition is the eventhub have 3 consumergroup and the input is configured only one consumer group

any helps?


“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Labels (1)
Tags (2)
0 Karma
1 Solution

aasabatini
Motivator

Hi All,

 

I found the solution by myself, seems the the ms add-on doesn't lost the events but received the logs from the eventhub very late.

I removed the defender for clouds logs from the eventhub and I used the MS graph api add-on.

now I can collect data near real time.

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

0 Karma

aasabatini
Motivator

Hi All,

 

I found the solution by myself, seems the the ms add-on doesn't lost the events but received the logs from the eventhub very late.

I removed the defender for clouds logs from the eventhub and I used the MS graph api add-on.

now I can collect data near real time.

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...