@rgresham_splunk  is this the only solution till date to forward event_id from splunk to phantom, or do we have any other method, we are looking to use Adaptive Response but because of event_id not getting populated in phantom we are not able to utilize this option. Thanking in advance.  ... View more

But seems there is no way to restrict a special users to access this user field. ... View more

Got it ! thank you so much Ernando:D ... View more

The old Windows-only add-on referenced in original question has been pulled down. Take a look at the new cross-platform Splunk Add-on for Microsoft Azure which pulls data from Azure Storage API using Azure Storage Python SDK. Among others, the Add-on leverages TableService and BlockBlobService which use core.windows.net endpoint for Azure cloud. You'll need to set endpoint_suffix to core.chinacloudapi.cn endpoint to access Azure China cloud instead. ... View more