Getting Data In

Why is my azure not sending all Windows Defender for Enpoint Alerts to Splunk?

dkeck
Influencer

Hi,

I try to figure this out for a week now and I am stucked. I installed the Microsoft 365 Defender Add-on for Splunk, which is the official supported TA referring to the Microsoft Partner docs.

I enabled the input for endpoint alerts and excepted the TA to index all alerts since the "start time" (2 weeks ago).

But only one event was send, the earliest event in the 14 days period. So in my case an event from 6/9/2021, the input was enabled on 23rd of June.

Splin internal is only telling me that the connection was successfull ( status 200) and how long it took.

I double checked all the siem intergration docs from microsoft , like what permissions need to be set and so on.

Here is the link https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-...

Does anyone know, if there are more options in azure that need to be turned on to make it more talkativ?

In Defender itself I can see way more alerts than 1 in the last 14 days.

Thank you

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...