splunk
Splunk Add-on for Microsoft Security
Splunk Cloud
Splunk Built
Overview
Details
The Splunk Add-on for Microsoft Security collects incidents and alerts from Microsoft 365 Defender OR alerts from Microsoft Defender for Endpoint.
Customers currently utilizing Microsoft 365 Defender Add-on for Splunk are strongly recommended to migrate to this new Splunk supported add-on after reading the migration section of the documentation. https://docs.splunk.com/Documentation/AddOns/released/MSSecurity/Migrate
Customers migrating from Microsoft 365 Defender Add-on for Splunk who would like to continue using the dashboards it includes should install Microsoft 365 App for Splunk, as the functionality has been moved there.
https://splunkbase.splunk.com/app/3786/
Microsoft 365 Defender Incidents
* Incident (impossible travel, activity from Tor IP, suspicious inbox forwarding, successful logon using potentially stolen credentials, etc.)
* Assignee
* Classification
* Severity
* Status
* Alerts associated with the Incident
Microsoft Defender for Endpoint Alerts
* Categories (Malware, Initial Access, Execution, etc.)
* Detection source
* Evidence
* Computer name
* Related user
* Severity
* Status
Customers currently utilizing Microsoft 365 Defender Add-on for Splunk are strongly recommended to migrate to this new Splunk supported add-on after reading the migration section of the documentation. https://docs.splunk.com/Documentation/AddOns/released/MSSecurity/Migrate
Customers migrating from Microsoft 365 Defender Add-on for Splunk who would like to continue using the dashboards it includes should install Microsoft 365 App for Splunk, as the functionality has been moved there.
https://splunkbase.splunk.com/app/3786/
Microsoft 365 Defender Incidents
* Incident (impossible travel, activity from Tor IP, suspicious inbox forwarding, successful logon using potentially stolen credentials, etc.)
* Assignee
* Classification
* Severity
* Status
* Alerts associated with the Incident
Microsoft Defender for Endpoint Alerts
* Categories (Malware, Initial Access, Execution, etc.)
* Detection source
* Evidence
* Computer name
* Related user
* Severity
* Status
The Splunk Add-on for Microsoft Security collects incidents and related information from Microsoft 365 Defender and alerts from Microsoft Defender for Endpoint.
Customers currently utilizing Microsoft 365 Defender Add-on for Splunk are strongly recommended to migrate to this new Splunk supported add-on after reading the migration section of the documentation.
Documentation for this add-on is posted at Splunk Docs.
Release Notes
Version 2.4.1
Dec. 5, 2024
Version 2.4.0
Nov. 25, 2024
Version 2.3.0
July 24, 2024
Support for IPv6
Version 1.3.1
Oct. 13, 2022