Intune Integration

[sc_admin12]

how to integrate microsoft intune in splunk using the connector downloaded from splunk base 

[marnall]

That connector is for Splunk SOAR, the SOAR product offered by Splunk. It will not work with Splunk Enterprise, the SIEM product offered by Splunk.

Currently it seems the go-to way to get intune logs into Splunk is to send them to a Microsoft Event Hub, and then use the Splunk Add-on for Microsoft Cloud Services to ingest them into Splunk.

https://splunkbase.splunk.com/app/3110