Unable to find sourcetype="ms365:defender:incident:alerts"?

[Gaikwad]

Unable to find sourcetype="ms365:defender:incident:alerts"

can u pls help 

[Gaikwad]

I'm trying to setup Microsoft 365 app for Splunk in that app ->Security-> defender -> Defender 365 overview dashboard. this dashboard is not working

when I check the query it contains  sourcetype="ms365:defender:incident:alerts" but same I'm unable to find it when I search for index = azure or index= main

as I check add is already there, only concern is unable to find that sourcetype="ms365:defender:incident:alerts"


so just want to know, if that source type is not there then is there a way available so we can configure that or any other solution is available  ?

thanks 

[richgalloway]

I just installed that app and don't see the same error message even though I have no ms365 data on my system.  By default, the dashboards in the app search index=* so they should be able to find the data if it exists.

Generally, when a sourcetype is not there it's because no data with that soucetype has been indexed.  Check your inputs and verify you have the appropriate add-on installed both on your indexers and search heads.

[Gaikwad]

@richgalloway 

thanks for your reply

as I check in input is not setup for sourcetype="ms365:defender:incident:alerts"?

can you please let me know, how can I setup input for this  "ms365:defender:incident:alerts"

[GaetanVP]

Hello,

Do you receive the MDE logs via an Azure Event Hub ? If it's the case the sourcetype of MDE logs could be "mscs:azure:eventhub".

Maybe if you just change the sourcetype specified in the MDE App Dashboard you could see some data.

sourcetype="mscs:azure:eventhub"

Or maybe you would need to rename sourcetype of your incoming MDE events.

Good luck!

[Gaikwad]

Hello @GaetanVP 

I tried to search those logs index =* sourcetype="mscs:azure:eventhub"

but no luck 

[GaetanVP]

Ok so you should at least to which indexes your MDE logs are going no?
The thing is that you first be able to find your MDE logs via a classic Splunk search, and then retrieve what is the sourcetype assigned to those logs.

Finally, try to change the MDE App Dashboard by modifying the sourcetype used there.

[richgalloway]

Please provide more information.  Where do you see this message?  What were you doing at the time?  Have you installed the proper add-on for the sourcetype?