icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Splunk Add on for Microsoft Azure
SHA256 checksum (splunk-add-on-for-microsoft-azure_403.tgz) 8fc18aa4ba8b74c923cd52e6a993c05e42701d6e555aab2fb4d7d373ac69f05b SHA256 checksum (splunk-add-on-for-microsoft-azure_402.tgz) ce50affb27b3d35c50ec056446f39b6fe3e7508fa14a5c18cd108773ed460433 SHA256 checksum (splunk-add-on-for-microsoft-azure_320.tgz) 655cd3bb75efa8cb012abd7a56deeeb90730d2b07d2b8f15b68cd9671a001c7b
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Splunk Add on for Microsoft Azure

Splunk Cloud
Splunk Labs
This app is NOT supported by Splunk. Please read about what that means for you here.
This add-on collects data from Microsoft Azure including the following:

Azure AD Data
- Users - Azure AD user data
- Interactive Sign-ins - Azure AD sign-ins including conditional access policies and MFA
- Directory audits - Azure AD directory changes including old and new values
- Devices - Registered devices in Azure AD
- Groups
- Risk Detections
Azure Log Analytics (KQL)
Estimated billing and consumption
- VM Reservation Recommendations
Inventory metadata
- Resource Groups - Resource group configuration
- Virtual Machines - VM, Disk, Image, and Snapshot configurations
- Virtual Networks - VNET, NSG, and Public IP configurations
- Managed Disks
- Subscriptions - Subscription name, ID, and type
- Topology - IaaS relationships
Azure Security Center
- Alerts
- Tasks
Azure Resource Graph

This add-on contains the following alert actions:

- Stop Azure VM - stops an Azure Virtual Machine.
- Add member to group - adds a user to a group. This can be useful if you need to enable additional policies like MFA based on search results.
- Dismiss Azure Alert - dismisses an Azure Security Center alert.

Version 3.0.0 and later of the Microsoft Azure Add-on for Splunk is compatible only with Splunk Enterprise version 8.0.0 and above.

While this app is not formally supported, the developer can be reached at https://github.com/splunk/splunk-add-on-microsoft-azure/issues. Responses are made on a best-effort basis. Feedback is always welcome and appreciated!

Documentation for this add-on is available at https://github.com/splunk/splunk-add-on-microsoft-azure/wiki

Release Notes

Version 4.0.3
Sept. 20, 2022
  • Fix - problem loading some inputs on Windows systems
  • Bumped splunktaucclib to version 6.0.6 to address potential credential corruption issues
  • Fix - nextLink parameter is different for consumption input causing limited results
  • Increased REST request timeout to 60 seconds
Version 4.0.2
July 13, 2022
  • BREAKING CHANGE - Removed deprecated event hub input. Use the Splunk Add-on for Microsoft Cloud Services to collect event hub data.

  • New input to collect Azure Log Analytics data via KQL queries

  • Added query parameters option to the Azure Active Directory Users input
  • Added query parameters option to the Azure Active Directory Groups input
  • Added filter parameter option to the Azure Active Directory Sign-ins input
  • Code is now open source https://github.com/splunk/splunk-add-on-microsoft-azure
Version 3.2.0
Sept. 2, 2021
  • New input to collect Azure Active Directory Groups
  • New alert action to stop an Azure Virtual Machine
  • New alert action to add a user to a group
  • New alert action to dismiss an Azure Security Center alert
  • jQuery updates

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.