It does not require an ITSI license. ITE is basically the free version of ITSI. It's the same code base, but they locked down a ton of features.  ... View more

@LCelley  As noted, you'll need to deploy a service exposed to Splunk Cloud email or webhook output. There are countless ways to do this, but the main problem is security. Your options for authenticating and authorizing commands sent from Splunk Cloud are very limited. An on-premise search head ("hybrid search") is probably a much safer option. I'm not sure why Splunk limits the ScheduledSearch feature in this license context, though. You'll want to contact your sales team (not support) and discuss your use case. ... View more

For completeness - Azure Active Directory P1 or P2 licensing is required for the signIns sourcetype. I've also raised a Github issue with Microsoft to address consistency errors between documentation that discusses the prerequisite license requirement.  https://docs.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-1.0&tabs=http https://docs.microsoft.com/en-us/graph/api/resources/azure-ad-auditlog-overview?view=graph-rest-1.0#what-licenses-do-i-need ... View more

Hi @LCelley, Choosing where to install DBConnect depends on your infrastructure. If your databases are on-premises, for security and performance reasons it is better to have DBConnect running on-premises HF. Because you will need to allow DB access from Splunk Cloud to your infrastructure. On your DB instances running on AWS  or GCP cloud (wherever your Splunk Cloud instances are running), you can consider using DBConnect on Splunk Cloud.  If this reply helps you un upvote is appreciated. ... View more