Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk Add-ons    We’re excited to announce an important update about the Splunk-supported add-ons available for bringing your Microsoft data into Splunk. To ensure you benefit from the latest features, best practices, and full Splunk support, we are transitioning all Splunk Add on for Microsoft Azure inputs to Splunk supported Technology Add-ons: Splunk Add-on for Microsoft Cloud Services, Splunk Add-on for Microsoft Office 365, and Splunk Add-on for Microsoft Security   Why Are We Doing This?  The Splunk Add-on for Microsoft Azure enables comprehensive data collection from Microsoft Azure, including Microsoft Entra ID data, Azure Log Analytics, billing, inventory, and security information - while also providing alert actions such as stopping Azure VMs, adding users to groups, and dismissing security alerts. However, it’s not officially supported by Splunk and will no longer receive updates or maintenance. By moving to Splunk-supported add-ons, you’ll benefit from:  Ongoing updates and maintenance  Full Splunk support and documentation  Compliance with best practices  Improved compatibility with Microsoft’s evolving APIs    What’s Changing?   The Splunk Add-on for Microsoft Azure will not be supported by its creators. It will remain available for download, but no further updates will be provided.    The Splunk Supported Add-ons (Splunk Add-on for Microsoft Cloud Services, Splunk Add-on for Microsoft Office 365, and Splunk Add-on for Microsoft Security) will now cover all integration points previously handled by the Splunk Add-on for Microsoft Azure.   What Do You Need to Do?  If you’re currently using the Splunk Add-on for Microsoft Azure, we recommend you start migrating your data inputs as soon as possible. The process is manual, but we’ve prepared comprehensive guides to help you every step of the way.  Step-by-Step Migration Instructions  We’ve created a consolidated migration guide that walks you through migrating each input, including:  Microsoft Entra ID (Users, Groups, Applications, Devices, Sign-ins, Audit, and Risk Detection)  Azure Metrics, Subscriptions, Resource Groups, Virtual Networks, Compute, KQL Log Analytics  Azure Billing and Consumption, Reservation Recommendations, Resource Graph, Topology  Alert Actions (Add member to M365 Group, Stop Azure VM, Dismiss Azure Alert)  Microsoft Graph Security API and Defender for Cloud data    For each input, you’ll find:  Which Splunk-supported Add-on  now handles it  Step-by-step disablement of the old input and creation of the new one  Direct links to official Splunk documentation for each data source    >>> Access the full migration guide here  <<<  We also recommend bookmarking this guide for future reference!  What If I Need Help?  While this migration is not officially supported by Splunk Support as a unique service, our support team will have all migration documentation ready, and they will answer your questions. If you run into issues, please use your standard customer support channels.  What Happens to the Splunk Add-on for Microsoft Azure?  The Splunk Add-on for Microsoft Azure will remain downloadable for now, but no further updates or fixes will be released.  The documentation will be archived and will direct users to the migration guide and supported Add-ons.  Deprecation notes will be added to the Splunkbase page and the Add-on documentation.  Spread the Word  To ensure everyone is informed:  We’ll add deprecation and migration notices to the Splunk Add-on for Microsoft Azure repository and documentation.  This blog post will serve as your central migration resource.  We’re Here for You  We know migrations can be daunting, but moving to supported Splunk Add-ons sets you up for success. You’ll be better positioned for future Microsoft and Splunk enhancements, and your integrations will be fully supported.  Thank you for being a valued part of the Splunk community! If you have questions, don’t hesitate to reach out through your usual support channels. ... View more

Amazon EventBridge is a serverless service that uses events to connect application components together, making it easier for you to build scalable event-driven applications. EventBridge will automatically deliver the events in near real-time. You can use Amazon EventBridge to route events from sources like homegrown applications, AWS, and third-party software to consumer applications across your organization. Amazon EventBridge offers a simple and consistent way to ingest, filter, transform, and deliver events and findings from AWS security services such as Amazon GuardDuty, Amazon Security Hub, AWS CloudTrail, AWS Config, and more. By leveraging Amazon EventBridge, Splunk users can receive security events and operational logs with minimal latency, ensuring timely insights and proactive monitoring. This blog explains how you can set up Amazon EventBridge to ingest events and findings from AWS in near real-time to Splunk over HEC (HTTP Event Collector).   Figure 1: Architecture for ingesting events into Splunk Step 1: Setup Splunk as API Destination Amazon EventBridge setup for Splunk requires you to set up an API destination target. Amazon EventBridge API destinations are HTTP endpoints that you can invoke as the target of an event bus rule, or pipe, similar to how you invoke an AWS service or resource as a target. Using API destinations, you can route events between AWS services, integrated software as a service (SaaS) applications, and public or private applications by using API calls. When you specify an API destination as a rule or pipe target, EventBridge invokes the HTTP endpoint for any event that matches the event pattern specified in the rule or pipe and then delivers the event information with the request. With EventBridge, you can use any HTTP method except CONNECT and TRACE for the request. The most common HTTP methods to use are PUT and POST.   To set up Splunk as the API destination:  go to Amazon Eventbridge in the AWS console  and select API Destinations under Integrations.  Now click Create API Destination and enter a name for API destination (Example: SplunkDestination).  Enter your Splunk Endpoint URL under API destination endpoint formatted for raw endpoint. (Example: https://<Your Splunk Endpoint URL>/services/collector/raw). If you use indexer port 8088 for your indexer’s endpoint, then include the port on the URL (Example: https://<Your Splunk Endpoint URL>:8088/services/collector/raw)   Select HTTP method as POST and for the Connection Type check Create a new connection.  Edit API destination: Figure 2: EventBridge API Destination Provide a name for the API connection Example: SplunkConnection Set the Destination Type to "Partners" AWS provides a pre-configured destination template for Splunk. Select Splunk as the destination from the Partner Destinations list. Choose the Authorization Type as "API Key". Configure API Key Value Pairs: Set Authorization as the API key name. Enter the HEC token prefixed with "Splunk". Example format: Splunk 123456az-2abc-1c22-3dfs-12a45b12078e (without quotes, replacing with your actual HEC token) Configure Invocation HTTP Parameters: Select Query string as the parameter type. Set Key to sourcetype. Set Value to the AWS source type you are configuring. Example for GuardDuty Findings: aws:cloudwatchlogs:guardduty Refer to Splunk AWS Add-on documentation for other AWS source types. (Optional) Configure Indexer Acknowledgement (if enabled for HEC input): Specify a channel to send data to HEC. Refer to Splunk documentation on indexer acknowledgment and data channels. To specify a channel: Select Header as the invocation parameter. Set Key to X-Splunk-Request-Channel. Enter the channel identifier in the Value field. Click "Create" to finalize the endpoint and connection for Splunk. Figure 3: EventBridge Splunk Connection Step 2: Set up EventBridge Rule  Now that you successfully created the API destination and connection for Splunk, you can create the EventBridge Rules on AWS console for sending events from AWS services.  Go to Amazon EventBridge in the AWS console , select Rules under Buses and click Create Rule.  Enter a name for the rule, then click Next. Keep Event source set to AWS events or EventBridge partner events. Scroll down to Event Pattern and select AWS services as the Event source. Choose the AWS service where you want to send events (e.g., GuardDuty). Set the Event type: Select All events to send all events from the AWS service. Or, choose a specific event type to send only certain events to Splunk. Important: The AWS service and event type should match the source type you configured in the previous step for the API destination.     Figure 4: Example EventBridge Rule On the next screen for EventBridge targets, check EventBridge API destination for Target types and select the target we created for Splunk earlier. With these steps you should be able to create the rule to ingest events into Splunk.   You can now verify [a3] on Splunk console by doing a search on the events sent from EventBridge. (Example: “index=<your_index> sourcetype="aws:cloudwatchlogs:guardduty") Depending on the type of events you selected, you may need to wait a few minutes until the events get generated from AWS service. For cost information on setting up Splunk as an API destination, refer to the EventBridge pricing page for API destinations and invocations.   When setting up the integration, it's important to monitor AWS logs and metrics for effective troubleshooting. Examining metrics for EventBridge such as event ingestion rates and error counts can help you identify performance bottlenecks or configuration problems early. By regularly reviewing these logs and metrics, you can make sure that your data is flowing smoothly to Splunk and address any issues promptly.   Conclusion This blog explains how to configure EventBridge for sending AWS events into Splunk. EventBridge provides at-least-once event delivery to targets, including automatic retries with exponential backoff for up to 24 hours. Events are stored durably across multiple Availability Zones (AZs), providing additional assurance your events will be delivered to their destination. These  availability and durability features provide an efficient solution for AWS customers to leverage EventBridge for delivering critical events to Splunk for Security and operational use cases. By combining AWS EventBridge event delivery mechanism with Splunk’s powerful data analytics, organizations can build a resilient and scalable monitoring solution that meets both security and operational requirements.   Authors: Antoni Komorowski - Splunk's Product Manager Ranjit Kalidasan - Principal Solutions Architect at AWS Bartlomiej Kaletka - Splunk's Product Manager ... View more