icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Splunkbase will be undergoing a scheduled migration and will be unavailable on Saturday, Oct 1, 2022, from 11AM to 3PM PDT

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Splunk Add on for Microsoft Azure
SHA256 checksum (splunk-add-on-for-microsoft-azure_403.tgz) 04abe975a31bd9e41acb0b75f74239565d94e48eb818541796ac0f55302dfe34 SHA256 checksum (splunk-add-on-for-microsoft-azure_402.tgz) b1156d97a55ad074b587c162d2ec4468b04f7a9c94fcd49fb0e440b1a18c9312 SHA256 checksum (splunk-add-on-for-microsoft-azure_320.tgz) d1228a9eb7cd4b568a9d20362918985e308de39190c5e272622007bcfd5d32c0
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

Splunk Add on for Microsoft Azure

Splunk Cloud
Splunk Labs
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
This add-on collects data from Microsoft Azure including the following:

Azure AD Data
- Users - Azure AD user data
- Interactive Sign-ins - Azure AD sign-ins including conditional access policies and MFA
- Directory audits - Azure AD directory changes including old and new values
- Devices - Registered devices in Azure AD
- Groups
- Risk Detections
Azure Log Analytics (KQL)
Metrics
Estimated billing and consumption
- VM Reservation Recommendations
Inventory metadata
- Resource Groups - Resource group configuration
- Virtual Machines - VM, Disk, Image, and Snapshot configurations
- Virtual Networks - VNET, NSG, and Public IP configurations
- Managed Disks
- Subscriptions - Subscription name, ID, and type
- Topology - IaaS relationships
Azure Security Center
- Alerts
- Tasks
Azure Resource Graph

This add-on contains the following alert actions:

- Stop Azure VM - stops an Azure Virtual Machine.
- Add member to group - adds a user to a group. This can be useful if you need to enable additional policies like MFA based on search results.
- Dismiss Azure Alert - dismisses an Azure Security Center alert.

Version 3.0.0 and later of the Microsoft Azure Add-on for Splunk is compatible only with Splunk Enterprise version 8.0.0 and above.

While this app is not formally supported, the developer can be reached at azure@splunk.com. Responses are made on a best-effort basis. Feedback is always welcome and appreciated!

Documentation for this add-on is available at https://github.com/splunk/splunk-add-on-microsoft-azure/wiki

Release Notes

Version 4.0.3
Sept. 20, 2022
  • Fix - problem loading some inputs on Windows systems
  • Bumped splunktaucclib to version 6.0.6 to address potential credential corruption issues
  • Fix - nextLink parameter is different for consumption input causing limited results
  • Increased REST request timeout to 60 seconds
Version 4.0.2
July 13, 2022
  • BREAKING CHANGE - Removed deprecated event hub input. Use the Splunk Add-on for Microsoft Cloud Services to collect event hub data.

  • New input to collect Azure Log Analytics data via KQL queries

  • Added query parameters option to the Azure Active Directory Users input
  • Added query parameters option to the Azure Active Directory Groups input
  • Added filter parameter option to the Azure Active Directory Sign-ins input
  • Code is now open source https://github.com/splunk/splunk-add-on-microsoft-azure
Version 3.2.0
Sept. 2, 2021
  • New input to collect Azure Active Directory Groups
  • New alert action to stop an Azure Virtual Machine
  • New alert action to add a user to a group
  • New alert action to dismiss an Azure Security Center alert
  • jQuery updates

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.