All Apps and Add-ons

Which Source Types can I use for Azure AD data in the Splunk Add-on for Microsoft Cloud Services?

cc1
New Member

We want to use the Splunk Add-on for Microsoft Cloud Services for the ingestion of data from the Azure Active Directory. For this we send data from our LogAnalyticsWorkspace (and an EventHub) to the Splunk TA (which is working). Unfortunately, the documentation is not very precise about the source types to use.

Which source types can I use for the following data?

  • Sign-ins (azure:monitor:aad ?)
  • Audit data (azure:monitor:aad ?)
  • AAD Risky Users
  • User Risk Events?

Thanks.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...