But seems there is no way to  restrict a special users to access this  user field. ... View more

How can we filter fields when sending the event to phantom from ES, by default, ES will send the all fields of the notable event to phantom, but a lot of them are useless for phantom's investigation. Thank you. ... View more

Got it ! thank you so much Ernando:D ... View more

The old Windows-only add-on referenced in original question has been pulled down. Take a look at the new cross-platform Splunk Add-on for Microsoft Azure which pulls data from Azure Storage API using Azure Storage Python SDK. Among others, the Add-on leverages TableService and BlockBlobService which use core.windows.net endpoint for Azure cloud. You'll need to set endpoint_suffix to core.chinacloudapi.cn endpoint to access Azure China cloud instead. ... View more