splunk
Splunk Add on for Microsoft Azure
Splunk Cloud
Splunk Labs
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
This add-on collects data from Microsoft Azure including the following:
Azure AD Data
- Users - Azure AD user data
- Interactive Sign-ins - Azure AD sign-ins including conditional access policies and MFA
- Directory audits - Azure AD directory changes including old and new values
- Devices - Registered devices in Azure AD
- Groups
- Risk Detections
Azure Log Analytics (KQL)
Metrics
Estimated billing and consumption
- VM Reservation Recommendations
Inventory metadata
- Resource Groups - Resource group configuration
- Virtual Machines - VM, Disk, Image, and Snapshot configurations
- Virtual Networks - VNET, NSG, and Public IP configurations
- Managed Disks
- Subscriptions - Subscription name, ID, and type
- Topology - IaaS relationships
Azure Security Center
- Alerts
- Tasks
Azure Resource Graph
This add-on contains the following alert actions:
- Stop Azure VM - stops an Azure Virtual Machine.
- Add member to group - adds a user to a group. This can be useful if you need to enable additional policies like MFA based on search results.
- Dismiss Azure Alert - dismisses an Azure Security Center alert.
Version 3.0.0 and later of the Microsoft Azure Add-on for Splunk is compatible only with Splunk Enterprise version 8.0.0 and above.
While this app is not formally supported, the developer can be reached at azure@splunk.com. Responses are made on a best-effort basis. Feedback is always welcome and appreciated!
Azure AD Data
- Users - Azure AD user data
- Interactive Sign-ins - Azure AD sign-ins including conditional access policies and MFA
- Directory audits - Azure AD directory changes including old and new values
- Devices - Registered devices in Azure AD
- Groups
- Risk Detections
Azure Log Analytics (KQL)
Metrics
Estimated billing and consumption
- VM Reservation Recommendations
Inventory metadata
- Resource Groups - Resource group configuration
- Virtual Machines - VM, Disk, Image, and Snapshot configurations
- Virtual Networks - VNET, NSG, and Public IP configurations
- Managed Disks
- Subscriptions - Subscription name, ID, and type
- Topology - IaaS relationships
Azure Security Center
- Alerts
- Tasks
Azure Resource Graph
This add-on contains the following alert actions:
- Stop Azure VM - stops an Azure Virtual Machine.
- Add member to group - adds a user to a group. This can be useful if you need to enable additional policies like MFA based on search results.
- Dismiss Azure Alert - dismisses an Azure Security Center alert.
Version 3.0.0 and later of the Microsoft Azure Add-on for Splunk is compatible only with Splunk Enterprise version 8.0.0 and above.
While this app is not formally supported, the developer can be reached at azure@splunk.com. Responses are made on a best-effort basis. Feedback is always welcome and appreciated!
Documentation for this add-on is available at https://github.com/splunk/splunk-add-on-microsoft-azure/wiki
Release Notes
Version 4.0.3
Sept. 20, 2022
- Fix - problem loading some inputs on Windows systems
- Bumped
splunktaucclibto version6.0.6to address potential credential corruption issues - Fix - nextLink parameter is different for consumption input causing limited results
- Increased REST request timeout to 60 seconds
Version 4.0.2
July 13, 2022
-
BREAKING CHANGE - Removed deprecated event hub input. Use the Splunk Add-on for Microsoft Cloud Services to collect event hub data.
-
New input to collect Azure Log Analytics data via KQL queries
- Added query parameters option to the Azure Active Directory Users input
- Added query parameters option to the Azure Active Directory Groups input
- Added filter parameter option to the Azure Active Directory Sign-ins input
- Code is now open source https://github.com/splunk/splunk-add-on-microsoft-azure
Version 3.2.0
Sept. 2, 2021
- New input to collect Azure Active Directory Groups
- New alert action to stop an Azure Virtual Machine
- New alert action to add a user to a group
- New alert action to dismiss an Azure Security Center alert
- jQuery updates