Add-ons for microsoft products

[Amire22]

I would appreciate help from anyone who has encountered a similar problem:

We are using Microsoft's E5 licensing with the following products:

• Intune
• Entra ID
• Defender for endpoint
• office 365
• teams

All events from Microsoft are streamed to EventHub and from there to our Splunk ES

We are very confused and don't know which Add-Ons we should install.

I would love to hear from anyone who uses these technologies.

Splunk Enterprise Security

[Amire22]

thank you

it will include logs from all my products above?

[PickleRick]

Not necessarily.

There are separate addons for specific services (separate one for Teams, another for Security (Defender and Defender for endpoint) and so on). This one will cover getting data from Event Hub but you might need another addon to parse your data properly and map fields to CIM.

I'm not sure though if the fact that you're pushing the data through Event Hub won't mangle the events since some of those addons expect the inputs to run differently (Graph API?).

You need to go to Splunkbase, type in "microsoft" and check it out

[kiran_panchavat · Accepted solution]

@Amire22 

Hello, you can install the Splunk Add-on for Microsoft Cloud Services add-on to onboard the logs to Splunk.  https://splunkbase.splunk.com/app/3110 

https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_Microsoft_Azure_Event_Hub... 

https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/