I know this is an old topic, but i recently had the same issue.  So maybe it will help someone else.  the mvzip takes 2 required and one optional parameter.  You can only combine two fields at a time, followed by any character as a delimiter.  in the example below, I use a pipe character | But i have discovered, you can nest the mvzip and then extract them out so for your example using FieldA, FieldB, and FieldC A simple mvzip would be: | eval combined_data=mvzip(FieldA,FieldB,"|") and that's it, but wait there's more, proceed with nesting | eval combined_data=mvzip(mvzip(FieldA,FieldB,"|"),FieldC,"|") next expand the mv field | mvexpand combined_data Finally, extract the fields in the same order you combined them: | rex field=combined_data "^(?<FieldA>[^|]*)\|(?<FieldB>[^|]*)\|(?<FieldC>[^|]*)"           ... View more

I even opened a support case with splunk.  They told me to read the development guide.  apparently this error is a mystery to anyone who sees it.  ... View more

Remove the port 8088.  Splunk cloud listens on https only change https://prd-p-571sl.splunkcloud.com:8088  to  https://http-inputs.prd-p-571sl.splunkcloud.com/services/collector   https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/UsetheHTTPEventCollector#Configure_HTTP_Event_Collector_on_managed_Splunk_Cloud:~:text=Send%20data%20to%20HTTP%20Event%20Collector%20on%20Splunk%20Cloud%20Platform ... View more

thank you.  how did you do that?  ... View more

Splunking Microsoft Teams Data | Splunk - https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-teams-data.html  ... View more

i totally agree.  This app does not handle 400 or 404 errors.  The developer  @jconger   is top notch though, i have met him.  just this one app have never really worked correctly We have to reset the inputs almost daily  By reset, we create a new subscription input.  Or we have to disable/reenable the call record or user report inputs However, i did perform the kvstore clean on both of our heavy fowarders (behind Load balancer) for a load balancer environment webhook, call record, and user report inputs are setup on both HF, but subscription is setup on only one This worked for me, for now disable all inputs  clean kvstore splunk clean kvstore -app TA_MS_Teams -collection TA_MS_Teams_checkpointer enable inputs in this order webhook, subscription, call record, user report   we have data again...for now.              ... View more

The incidents and alerts inputs for this add-on work perfectly!  We bring them in all day.   The alert_actions do not work very well.  We are using the workaround @jconger  mentioned below.   We have the makeresults command setup as a scheduled report to bring in custom advanced threat hunting queries.  @jconger  - on the next release, could you add a custom KQL input?  This would be similar to how TA for Defender ATP hunting API | Splunkbase does this.  There is an input to simply run the KQL against defender api.  The makeresults command already has the correct structure.  ... View more

I have not seen a reliable way to pull in Log Analytics workspace data into splunk https://splunkbase.splunk.com/app/4127/ - no longer functions on 8.2.x - developer no longer updating the add-on.  This was a great add-on, worked for 2 years.   now it's gone   https://splunkbase.splunk.com/app/4847/ - This will pull in the data, but it's a mess.  There are no field extractions, and it pulls in data you do not need like table structure, and row structure.  But it does not map them together or extract a single field.  There is an option for CSV or JSON, both do the same thing, just brings in a pile of data.  Splunk has nothing for this.   ... View more

Log Analytics is not mentioned in the above listing unfortunately ... View more

Log Analytics is not mentioned in this article unfortunately ... View more

nice response.  Thank you. What if the event log has spaces, found in the Applications and services node? Do we need quotes or anything?  [WinEventLog://Microsoft-Windows-AppLocker/EXE and DLL] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/MSI and Script] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Deployment] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Execution] disabled = 0 index = wineventlog interval = 60 ... View more

maybe, if you have time from all the .conf questions you have coming in; make an input that only runs the hunting queries? the only last thing we have is the timestamp recognition.  it uses the calling time instead of the Timestamp you have configured.  ... View more

hi jason, one question about the timestamp parsing using your makeresults command.  All the events come in with the exact same _time value.   so we get this when searching Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk." Where do you set the timestamp parsing?  we tried props, but it did not take affect   ... View more

Thank you Jason, Here is a simple KQL which works with makeresults, but not with the alert_action AlertEvidence | where Timestamp > ago(7d) | makeresults | eval index="main", tenant_id="12345-02da-47f3-a903-12345", query="AlertEvidence | where Timestamp > ago(7d)" | sendalert defender_advanced_hunting param.account_name="MDATP_API_Access" param.global_account_name="MDATP_API_Access" Next, I look in the logs: index=cim_modactions source="/opt/splunk/var/log/splunk/defender_advanced_hunting_modalert.log" signature=* | table _time action_mode signature | sort - _time Which brings this result 2021-10-20 08:49:31.570 adhoc Successfully created splunk events 2021-10-20 08:49:30.763 adhoc do_query() - Number of results : 28792 2021-10-20 08:49:10.417 adhoc _Splunk_ Getting proxy server. 2021-10-20 08:49:08.786 adhoc _Splunk_ Defender account name : MDATP_SEAR_API_Access 2021-10-20 08:49:08.774 adhoc _Splunk_ Alert action defender_advanced_hunting started. 2021-10-20 08:49:04.150 adhoc Invoking modular action Next i added the exact same copy/paste search to a saved search in the alert actionk, Defender Advanced Hunting 2021-10-20 08:50:15.183 saved _Splunk_ Error getting ta_ms_defender_account: 'ta_ms_defender_account' 2021-10-20 08:50:15.177 saved _Splunk_ Alert action defender_advanced_hunting started. 2021-10-20 08:50:10.776 saved Invoking modular action ... View more

Affirmative.  Installed on both Heavy Forwarder and search head cluster.  We have continued to run into issues with the alert_action The Event Hub works well from Defender, the challenge is volume.  Our defender data brings in 1.5TB per day into Splunk.  The SOC needs the Advanced Threat hunting data along with the incidents and alerts.   We were using Add-on for Defender ATP Hunting API to bring in the Hunting API.  However, that stopped working with 8.2.   So we are considering a method to use the Event Hub, and then maybe filter inputs to only what we need.  A poor man's threat hunting?  ... View more

interesting, we now have hundreds of thousands of events in main, but none in the correct index   index=main sourcetype="stash_common_action_model*" ... View more

Thank you Jason, Here is a search we executed: | makeresults | eval index="cloud_security_microsoft", tenant_id="<TENANT ID>", query="DeviceEvents | where ActionType == 'AntivirusScanCompleted' | where Timestamp > ago (1h)" | sendalert defender_advanced_hunting param.account_name="MDATP_API_Access" param.global_account_name="MDATP_API_Access"   This gave us data, but in the main index, and with the incorrect sourcetype The results are here: index=main sourcetype="stash_common_action_model-6" InitiatingProcessCreationTime=*         ... View more

our setup: Heavy Forwarder - account setup, and inputs configured to pull Incidents and Alerts Search Head Cluster - Account name setup there also SHC - Alert Action with Advanced Hunting set - Test - KQL - Alert ... View more

Here is the full log from the last run of the alert: 2021-10-05 18:25:05,937 INFO pid=16772 tid=MainThread file=cim_actions.py:message:431 | sendmodaction - worker="SEARCH-HEAD" signature="Invoking modular action" action_name="defender_advanced_hunting" search_name="Test - KQL - Alert" sid="scheduler_YWRtLWpvaG5ueS5ibGl6emFyZA_VEEtTVNfRGVmZW5kZXI__RMD5e3ec459a641895e9_at_1633458300_871_C0398236-4083-4264-97A9-2408308CBC8C" rid="0" app="TA-MS_Defender" user="splunk-admin-user" digest_mode="1" action_mode="saved" 2021-10-05 18:25:10,336 INFO pid=16772 tid=MainThread file=cim_actions.py:message:431 | sendmodaction - worker="SEARCH-HEAD" signature="_Splunk_ Alert action defender_advanced_hunting started." action_name="defender_advanced_hunting" search_name="Test - KQL - Alert" sid="scheduler_YWRtLWpvaG5ueS5ibGl6emFyZA_VEEtTVNfRGVmZW5kZXI__RMD5e3ec459a641895e9_at_1633458300_871_C0398236-4083-4264-97A9-2408308CBC8C" rid="0" app="TA-MS_Defender" user="splunk-admin-user" digest_mode="1" action_mode="saved" action_status="success" 2021-10-05 18:25:10,343 INFO pid=16772 tid=MainThread file=cim_actions.py:message:431 | sendmodaction - worker="SEARCH-HEAD" signature="_Splunk_ Defender account name : MDATP_SEAR_API_Access" action_name="defender_advanced_hunting" search_name="Test - KQL - Alert" sid="scheduler_YWRtLWpvaG5ueS5ibGl6emFyZA_VEEtTVNfRGVmZW5kZXI__RMD5e3ec459a641895e9_at_1633458300_871_C0398236-4083-4264-97A9-2408308CBC8C" rid="0" app="TA-MS_Defender" user="splunk-admin-user" digest_mode="1" action_mode="saved" action_status="success" 2021-10-05 18:25:10,348 ERROR pid=16772 tid=MainThread file=cim_actions.py:message:431 | sendmodaction - worker="SEARCH-HEAD" signature="get_credentials_with_account_name() - Type 3 - The stanza name None specified is not in the global account configuration. Tested with stanza name : MDATP_SEAR_API_Access. Retrying ... " action_name="defender_advanced_hunting" search_name="Test - KQL - Alert" sid="scheduler_YWRtLWpvaG5ueS5ibGl6emFyZA_VEEtTVNfRGVmZW5kZXI__RMD5e3ec459a641895e9_at_1633458300_871_C0398236-4083-4264-97A9-2408308CBC8C" rid="0" app="TA-MS_Defender" user="splunk-admin-user" digest_mode="1" action_mode="saved" action_status="failure" 2021-10-05 18:25:10,348 ERROR pid=16772 tid=MainThread file=cim_actions.py:message:431 | sendmodaction - worker="SEARCH-HEAD" signature="get_credentials_with_account_name() - Type 3 - Exception occurred. The global account name specified has not been configured. Please re-configure them or re-enter the right stanza name." action_name="defender_advanced_hunting" search_name="Test - KQL - Alert" sid="scheduler_YWRtLWpvaG5ueS5ibGl6emFyZA_VEEtTVNfRGVmZW5kZXI__RMD5e3ec459a641895e9_at_1633458300_871_C0398236-4083-4264-97A9-2408308CBC8C" rid="0" app="TA-MS_Defender" user="splunk-admin-user" digest_mode="1" action_mode="saved" action_status="failure" ... View more

Any information, documents, writeups or examples on how to use these new Alert actions would be incredibly useful.  What is the variable format in the Incident Update alert action?  I'm assuming $fieldname$?  for the Hunting query, do we need to replace the > character with ;gt ?   We have the inputs on a heavy forwarder and the add-on installed on the search head cluster.   ... View more

This appears to be corrected in version 1.3.0 ... View more

I see this one is kinda older, but did you find a solution? my inputs seem to stop every few days or less.  Sometimes cloning all the inputs corrects it, sometimes it does not.  ... View more

I made one adjustment in case you need the days to show up If days are less than 1, there will be no value, so fillnull to 0 | makeresults | eval minutes=1698 | eval result = tostring(minutes*60, "duration") | rex field=result "((?P<day>\d+)\+){0,1}(?P<hour>\d{2}):(?P<min>\d{2}):(?P<sec>\d{2})" | fillnull value=0 day | eval result = day." days ".hour." hours ".min." minutes ".sec." seconds" | table result Adjusting the minutes value: | makeresults | eval minutes=111698 | eval result = tostring(minutes*60, "duration") | rex field=result "((?P<day>\d+)\+){0,1}(?P<hour>\d{2}):(?P<min>\d{2}):(?P<sec>\d{2})" | fillnull value=0 day | eval result = day." days ".hour." hours ".min." minutes ".sec." seconds" | table result ... View more