All Apps and Add-ons

Which Source Types can I use for Azure AD data in the Splunk Add-on for Microsoft Cloud Services?

cc1
New Member

We want to use the Splunk Add-on for Microsoft Cloud Services for the ingestion of data from the Azure Active Directory. For this we send data from our LogAnalyticsWorkspace (and an EventHub) to the Splunk TA (which is working). Unfortunately, the documentation is not very precise about the source types to use.

Which source types can I use for the following data?

  • Sign-ins (azure:monitor:aad ?)
  • Audit data (azure:monitor:aad ?)
  • AAD Risky Users
  • User Risk Events?

Thanks.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...