splunk
Splunk Add on for Microsoft Azure
Splunk Cloud
Splunk Labs
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
This add-on collects data from Microsoft Azure including the following:
Microsoft Entra ID (formerly Azure Active Directory) Data
- Users - Microsoft Entra ID user data
- Interactive Sign-ins - Microsoft Entra ID sign-ins including conditional access policies and MFA
- Directory audits - Microsoft Entra ID directory changes including old and new values
- Devices - Registered devices
- Groups
- Risk Detection
Microsoft Security Graph API
Topology - IaaS relationships
Azure Security Center
- Alerts
- Tasks
Azure Resource Graph
This add-on contains the following alert actions:
- Stop Azure VM - stops an Azure Virtual Machine.
- Add member to group - adds a user to a group. This can be useful if you need to enable additional policies like MFA based on search results.
- Dismiss Azure Alert - dismisses an Azure Security Center alert.
Version 3.0.0 and later of the Microsoft Azure Add-on for Splunk is compatible only with Splunk Enterprise version 8.0.0 and above.
While this app is not formally supported, the developer can be reached at https://github.com/splunk/splunk-add-on-microsoft-azure/issues. Responses are made on a best-effort basis. Feedback is always welcome and appreciated!
Microsoft Entra ID (formerly Azure Active Directory) Data
- Users - Microsoft Entra ID user data
- Interactive Sign-ins - Microsoft Entra ID sign-ins including conditional access policies and MFA
- Directory audits - Microsoft Entra ID directory changes including old and new values
- Devices - Registered devices
- Groups
- Risk Detection
Microsoft Security Graph API
Topology - IaaS relationships
Azure Security Center
- Alerts
- Tasks
Azure Resource Graph
This add-on contains the following alert actions:
- Stop Azure VM - stops an Azure Virtual Machine.
- Add member to group - adds a user to a group. This can be useful if you need to enable additional policies like MFA based on search results.
- Dismiss Azure Alert - dismisses an Azure Security Center alert.
Version 3.0.0 and later of the Microsoft Azure Add-on for Splunk is compatible only with Splunk Enterprise version 8.0.0 and above.
While this app is not formally supported, the developer can be reached at https://github.com/splunk/splunk-add-on-microsoft-azure/issues. Responses are made on a best-effort basis. Feedback is always welcome and appreciated!
Documentation for this add-on is available at https://github.com/splunk/splunk-add-on-microsoft-azure/wiki
Release Notes
Version 4.2.0
Nov. 15, 2024
Version 4.1.0
July 31, 2024
Version 4.1.0
- Added an input for Microsoft Entra ID Applications. Issue #27
-
Added an input for Microsoft Graph Security API
-
Deprecated the Azure Metrics input. This functionality has moved to the Splunk Add-on for Microsoft Cloud Services.
- Deprecated the Azure Subscriptions input. This functionality has moved to the Splunk Add-on for Microsoft Cloud Services.
- Deprecated the Azure Resource Groups input. This functionality has moved to the Splunk Add-on for Microsoft Cloud Services.
- Deprecated the Azure Virtual Networks input. This functionality has moved to the Splunk Add-on for Microsoft Cloud Services.
- Deprecated the Azure Compute input. This functionality has moved to the Splunk Add-on for Microsoft Cloud Services. *
Version 4.0.3
Sept. 20, 2022
- Fix - problem loading some inputs on Windows systems
- Bumped
splunktaucclibto version6.0.6to address potential credential corruption issues - Fix - nextLink parameter is different for consumption input causing limited results
- Increased REST request timeout to 60 seconds
Version 4.0.2
July 13, 2022
-
BREAKING CHANGE - Removed deprecated event hub input. Use the Splunk Add-on for Microsoft Cloud Services to collect event hub data.
-
New input to collect Azure Log Analytics data via KQL queries
- Added query parameters option to the Azure Active Directory Users input
- Added query parameters option to the Azure Active Directory Groups input
- Added filter parameter option to the Azure Active Directory Sign-ins input
- Code is now open source https://github.com/splunk/splunk-add-on-microsoft-azure
Version 3.2.0
Sept. 2, 2021
- New input to collect Azure Active Directory Groups
- New alert action to stop an Azure Virtual Machine
- New alert action to add a user to a group
- New alert action to dismiss an Azure Security Center alert
- jQuery updates