I would appreciate help from anyone who has encountered a similar problem: We are using Microsoft's E5 licensing with the following products: Intune Entra ID Defender for endpoint office 365 teams All events from Microsoft are streamed to EventHub and from there to our Splunk ES We are very confused and don't know which Add-Ons we should install. I would love to hear from anyone who uses these technologies. Splunk Enterprise Security ... View more

Hello I have a search head configured with assets and identity from current ad domain. I have 5 more ad domains without trust and on different networks. In each domain / network I have a HF sending data to indexers. How can I set those domains to send assets and identity information to my search head? Thank you Splunk Enterprise Security   ... View more