2 things to check. 1 - I've seen instances where firewall devices inject private cert on outbound traffic causing error messages like this.  Adding an exception for the Splunk forwarder resolved the issue. 2 - if you are using self-signed or internal certs, you may need to add the cert to the add-on's trust list. Navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/lib/certifi Edit cacert.pem file Append the contents of your root certificate to this file Restart Splunk ... View more

The Message Trace input requires an additional step that isn't needed for the other inputs.  Did you add the Azure AD app registration to one of the following IAM roles? Exchange Administrator Global Administrator Global Reader role (recommended) https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputmessagetrace ... View more

To get Microsoft Defender XDR data into Splunk, use the Splunk Add-on for Microsoft Security => https://splunkbase.splunk.com/app/6207 All the Microsft Defender XDR incidents, alerts, entities, evidence, etc. are collected by this add-on. ... View more

Where are you applying the Event Hubs Data Receiver role?  I usually apply it at the Subscription level so that any other namespaces created in the same subscription will inherit the necessary permissions.  There is a walkthrough here (Step 4) => https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_Microsoft_Azure_Event_Hub_data The SSL error you are getting may be a private certificate in the certificate chain.  I have also seen similar issues when a network device injects a private cert in the header in outbound traffic. ... View more

The best way is to send your Microsoft Entra ID (formerly Azure AD) data to an event hub.  Then, use the Splunk Add-on for Microsoft Cloud Services to ingest the data (hint: use the azure:monitor:aad sourcetype).  Here's a Lantern article for setting up the add-on => https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_Microsoft_Azure_Event_Hub_data   Alternatively, you can use Splunk Add-on for Microsoft Azure.  Use the "Azure Active Directory Interactive Sign-ins" input to get the data.  Depending on your environment size, you may hit some throttling limitations with the REST API this add-on uses => https://github.com/splunk/splunk-add-on-microsoft-azure/wiki/Configure-Azure-Active-Directory-inputs-for-the-Splunk-Add-on-for-Microsoft-Azure#throttling-guidance ... View more

Install the Splunk Add-on for Microsoft Cloud Services and configure the Azure Resource input.  Choose "Snapshot Data" as the resource type (see screenshot).   ... View more

Install the Splunk Add-on for Microsoft Cloud Services and configure the Azure Resource input.  Choose "Disk Data" as the resource type (see screenshot). Then, you can use this search to find unattached (orphaned) disks: index=main sourcetype="mscs:resource:disk" properties.diskState="unattached"     ... View more

I can confirm that the checkpoint data is stored in the KV Store on the forwarder.  The checkpoint is the last timestamp retrieved from the Azure REST API.  So if you use a new forwarder, the data will be ingested again (duplicate data). ... View more

The "Bad request for url..." verbiage typically points to an invalid webhook address.  Make sure the URL of the webhook is publically accessible, is addressable with HTTPS, and doesn't contain any private certificates in the chain.  This Lantern article (with a video walkthrough) may be helpful => https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_the_Microsoft_Teams_Add-on_for_Splunk   As, an alternative, you can use Azure Functions to get the same call record data.  This way, you don't have to have the webhook on your forwarder.  Instead, all the plumbing happens in Azure and the data is pushed to Splunk via HEC.  Here is a Lantern article on that => https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_Microsoft_Teams_call_record_data_and_Azure_Functions ... View more

Another option is to use Microsoft Visual Studio Code ( https://code.visualstudio.com/ ).  VSCode lets you find/replace text in multiple files. While I'm here, I'll add a shameless plug for the Splunk VSCode extension ( https://marketplace.visualstudio.com/items?itemName=Splunk.splunk ).  The extension will provide IntelliSense for .conf files, it has snippets for common configurations, provides a debug mechanism for those who code on top of Splunk, and more. ... View more

The 404 message about the checkpoint is not unexpected.  Here's why: When the input runs, it has to calculate a date range to ask for data from the API The start date in that range is calculated like this: Look for a checkpoint value If there is no checkpoint value, look for a start date specified in the input If there is no start date specified on the input, use a date 5 days in the past Once a start date is identified, an end date is calculated by adding the number of minutes specified in the query window size Once data is collected, a checkpoint will be set to the largest time stamp seen during collection When the input runs again to calculate a start date, the checkpoint value will be used So, if you have never collected data, you'll get a 404 trying to retrieve a checkpoint that doesn't yet exist. It looks like your query window size is set to 60 based on the logging messages.  This is typically okay in a production environment, but you may need to increase it if you're testing a low-volume environment.  I've seen this in dev/test environments and set the window to 1440 (24 hours) to ensure some data is retrieved. ... View more

In your case, it looks like the start date is too far in the past (note the $filter parameter of 2020-03-24)   https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$orderby=activityDateTime&$filter=activityDateTime+gt+2020-03-24T15:21:02.3519945Z+and+activityDateTime+le+2022-09-26T23:38:24.006432Z   I don't see a start date in your inputs.conf parameters posted, so it could be using an old checkpoint date for the start date.  The checkpoint is stored in the KV store, and you can clear it out with a combination of | inputlookup and | outputlookup, but it is easier to just create a new input with a different name since checkpoints key off of the input name. ... View more

Are you creating inputs via the UI or editing inputs.conf directly? The endpoint used (the part between graph.microsoft.com/ and /auditLogs ) comes from the endpoint parameter in inputs.conf [MS_AAD_audit://aad_audit] audit_sourcetype = azure:aad:audit azure_app_account = test endpoint = v1.0 environment = public index = azure interval = 86400 query_backoff_throttle = 420 query_window_size = 0 tenant_id = REDACTED ... View more

Was the API permission granted? Also, was the role added at the directory level? The input recreation suggestion was for the OP since they were getting a 404 on the KV store. A question about the tenant was mentioned in the thread above.  The tenant is specified at the input level.  Are you setting up a "Microsoft Office 365 Message Trace (OAuth)" input?  That input requires the tenant ID; whereas, the "Microsoft Office 365 Message Trace (Basic Auth)" input does not. ... View more

Setting up the permissions for this add-on is a 2 step process: For the Azure AD app registration, add the ReportingWebService.Read.All API permission. This can be found by going to APIs my organization uses => Office 365 Exchange Online.  See the attached screenshot The Azure AD app registration needs to be assigned a directory role. The minimum role that works is Global Reader.  Here is a walkthrough on how to do that => https://docs.microsoft.com/en-us/azure/active-directory/roles/manage-roles-portal ... View more

That 404 error indicates a KV store issue.  Try cloning your input and then disabling or deleting the existing input. ... View more

The checkpoint is kept in the KV store.  You can update the value using a combination of the inputlookup command and the outputlookup command.  But, honestly, it is easier to clone the existing input with a different name because the checkpoint keys off the input name. ... View more

Was this a clean install or upgrade? ... View more

Version 2.x is out and supports modern authentication (OAuth). https://splunkbase.splunk.com/app/3720/ ... View more

Update: the originally required permissions were either Global Administrator or Exchange Administrator.  However, Microsoft has changed that to now allow the Global Reader role. ... View more

The originally required permissions were either Global Administrator or Exchange Administrator.  However, Microsoft has changed that to now allow the Global Reader role. ... View more

Yes.  Version 2.x is out and supports modern authentication (OAuth)! https://splunkbase.splunk.com/app/3720/ ... View more