Version 2.x is out and supports modern authentication (OAuth)! https://splunkbase.splunk.com/app/3720/ ... View more

Yes, we have draft documentation from Microsoft for programmatic OAuth access to the Reporting Web Services API.  I've tested this in my internal lab and it works!  The add-on coding is happing as I type this message... ... View more

Hi Raphy, Thanks for the reference to the Microsoft article.  That article details how to use OAuth with IMAP, POP, and SMTP with Exchange Online.  The API this add-on uses is different - it is called the Reporting Web Service.  But, I do have some good news.  We received draft documentation from Microsoft for OAuth with the Reporting Web Service, and coding is currently underway to get this add-on updated. ... View more

We are waiting on an update to the Microsoft API that the add-on uses.  Once that is released from Microsoft, we will update the add-on to use modern authentication. ... View more

We are in touch with Microsoft, and we are waiting on an updated API.  According to this document, the Reporting Web Services (the service this add-on uses) will have OAuth support by the end of May 2022.  We will update the add-on to work with Modern authentication when it is implemented in the API. ... View more

We have been in contact with Microsoft about this.  There are near-term and long-term solutions coming.  Neither solution is publicly available as of the date of this writing, but we will update the add-on accordingly when a release does happen. ... View more

In the screenshot above, the API token is the value to use for the "Cloud App Security Token". ... View more

It's possible to do this type of thing in the UI too.  Go to Settings > Source Types > choose the sourcetype > Advanced > New setting > Save ... View more

TL;DR = the last three parameters (Cloud App Security Token, Tenant Subdomain, and Tenant Data Center) are only used by the Cloud Application Security Input.  If you do not plan on using that input in the add-on, you can leave those fields blank.  If you do plan on using that input, here is a quick how-to about getting the needed values: Log on to the Cloud App Security portal https://portal.cloudappsecurity.com/ Once logged in, go to Settings > Security extensions Click the Add token button Give the token a name and click Generate The token will be displayed.  This is the only time the token will be displayed by the way. Copy the token, tenant subdomain (splunkpartner in my case), and data center (us3 in my case).   The first three parameters (Tenant ID, Client ID, and Client Secret) are used by the following inputs: Management Activity Service Status Service Message Graph API The Microsoft 365 App has a good walkthrough about creating the Azure AD application registration and assigning the necessary permissions (it is in the Help > Setup Guide menu in the app).  If you are configuring additional Microsoft Cloud add-ons, here is a good reference for the necessary permissions needed along with sourcetypes and APIs used => http://bit.ly/Splunk_Azure_Permissions   ... View more

TL;DR = we are waiting on an updated API from Microsoft. Background: The O365 reporting add-on utilizes a Microsoft API called the Office 365 Reporting web service.  This API only supports basic authentication, so we're stuck with that for the time being.  There currently is no other Microsoft API for O365 message trace data.  That being said, we have worked with Microsoft on some of their preview code that will support modern authentication.  As soon as Microsoft's code becomes publically available, the O365 reporting add-on will be updated on Splunkbase.  Also, there are plans to get this functionality moved over to the Splunk-supported O365 add-on. ... View more

Do you have the Common Information Model add-on installed? ... View more

The alert actions are utilized by the workflow actions (check out workflow_actions.conf) and dashboards (check out the incident_detail.xml dashboard).  However, the actions can be used independently as well. Here is an example of using the alert action independently via SPL to hunt based on an IP address: | makeresults | eval index="YOUR INDEX (defaults to main)", tenant_id="YOUR TENANT ID", query="let ip='IP ADDRESS'; search in (DeviceNetworkEvents, DeviceFileEvents, DeviceLogonEvents, DeviceEvents, EmailEvents, IdentityLogonEvents, IdentityQueryEvents, IdentityDirectoryEvents, CloudAppEvents) Timestamp between (ago(7d) .. now()) and (IPAddress == ip or LocalIP == ip or FileOriginIP == ip or RequestSourceIP == ip or SenderIPv4 == ip or SenderIPv6 == ip or RemoteIP == ip or DestinationIPAddress == ip) | top 100 by Timestamp" | sendalert defender_advanced_hunting The results will be indexed into whatever index you specified.  If you do not include the index in the search, results will go in the main index.   The sourcetype will be m365:defender:incident:advanced_hunting. Search for the results of the hunting action: index="YOUR INDEX" sourcetype="m365:defender:incident:advanced_hunting"   As mentioned, these alert actions are utilized by workflow actions.  To observe this, navigate to the Defender 365 Incident Queue dashboard, select an incident (the Incident Detail dashboard should open), select the Entities button in the dashboard, expand the entity, and select Event Actions (see screenshot below).  Depending on the entityType field, different actions will appear.  Currently, the add-on implements workflow actions for IP addresses, Users, and Files.  This can be expanded to other types of entities by editing the workflow_actions.conf file.     Still with me?  Okay, because there is a different way to get this hunting data.  The workflow actions are ad-hoc hunting queries, but you can continuously export all of this table data to an event hub from Defender.  Then, use the Splunk Add-on for Microsoft Cloud Services to ingest the data from the event hub.  If you go this route, I suggest installing this add-on that maps all of the Defender event hub data to the Common Information Model (CIM) => https://splunkbase.splunk.com/app/5518/ ... View more

I've heard of this before, and it was an issue with the "Firewalls and virtual networks" settings in the Networking section on the event hub namespace.  The settings were blocking the incoming connection from the Splunk add-on.  After allowing the IP address (or CIDR) of the Splunk forwarder, data started coming in. Reference => https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-ip-filtering ... View more

The webhook URL for the subscription input must use a certificate signed by a public CA.  A lot of customers use the address of a load balancer or reverse proxy for the webhook URL.  Then, network rules are set up to forward that traffic to one or more Splunk Heavy Forwarders running the Teams webhook input.  Internal certificates can be used for this part if desired.  On a purely technical level, you do not have to use a certificate from the load balancer to the HF. Example traffic flow: MSFT == HTTPS ==> Webhook URL (load balancer) == (HTTP|HTTPS) ==> HF running a Teams webhook input   ... View more

Azure AD exists above subscriptions.  So, "no" you don't need a subscription to get Azure AD logs. To get Azure AD logs via the Splunk add-on, you will need to grant your Azure AD app registration the AuditLog.Read.All permission.  Additionally, you will need at least a P1 version of Azure AD to get sign-in logs. Refer to this spreadsheet for necessary permissions => http://bit.ly/Splunk_Azure_Permissions ... View more

Here is a spreadsheet detailing the necessary permissions for various add-on's and their inputs. http://bit.ly/Splunk_Azure_Permissions For the Splunk Add-on for Microsoft Cloud Services, you do not need any special API permissions, but you do need to grant your Azure AD app registration Reader access to your subscription. ... View more

A 403 error is typically a permissions issue with the Azure AD app registration.  Check the permissions by going to https://portal.azure.com  Go to Azure Active Directory > App registrations > find your app registration the add-on is using > API permissions.  To get user data, you will need to have Microsoft Graph User.Read.All. For details on the various permissions needed for specific inputs, refer to this link -> http://bit.ly/Splunk_Azure_Permissions ... View more

Can you share your inputs.conf? Also, you can view the checkpoints by doing the following: Add the following lines to transforms.conf in the app: [TA_Defender_checkpoint_lookup] collection = TA_MS_Defender_checkpointer external_type = kvstore fields_list = _key, state   Run the following search: | inputlookup TA_Defender_checkpoint_lookup | eval key = _key   ... View more

Version 1.0.3 of the add-on adds proxy support. https://splunkbase.splunk.com/app/4994/ ... View more

Version 3.0.0 of the add-on supports Splunk 8.x now. ... View more

Here are the 3 most common issues: Using a Splunk 8 instance - the Event Hub input does not work on Splunk 8 (yet) Entering an Event Hub key instead of an Event Hub connection string Entering an Event Hub Namespace instead of an individual Event Hub Name ... View more