Microsoft Teams Add-on for Splunk
Overview
Details
* Call records
* Type
* Organizer and participants
* Modalities
* Start and end times
* https://docs.microsoft.com/en-us/graph/api/resources/callrecords-callrecord
* Call record sessions
* Caller and callee endpoint data
* Failure information (if any)
* Start and end times if individual sessions
* https://docs.microsoft.com/en-us/graph/api/resources/callrecords-session
* Call record session segments
* Call media used
* Bandwidth
* Packet loss rate
* Round trip time
* Audio degradation and jitter
* Video frame rate, frame loss, packet loss, and processing capability
* Device information
Refer to the "Details" tab for setup instructions.
Microsoft Teams Add-on for Splunk
This add-on collects data from Microsoft Teams including the following:
- Call types
- Call modalities
- Clients used
- Audio jitter
- Packet utilization
About
- Version: 1.0.0
-
Vendor Products:
- Microsoft Teams user activity reports - (beta API)
- Microsoft Teams call records - (beta API)
-
Splunk platform versions: 7.3 and later
- Platforms: Platform independent
- Visible: Yes, this add-on contains configuration
Prerequisites
- An active Teams Subscription
- An Azure Active Directory application registration
- For call records, a publicly accessible HTTPS endpoint is needed
Required APIs and Permissions
- CallRecords.Read.All (Application)
- Subscriptions.Read.All (Delegated)
- Reports.Read.All (Delegated and Application)
Installing
Where to install this add-on
Unless otherwise noted, all supported add-ons can be safely installed to all tiers of a distributed Splunk platform deployment. See Where to install Splunk add-ons in Splunk Add-ons for more information.
This table provides a reference for installing this specific add-on to a distributed deployment of Splunk Enterprise.
| Splunk platform component | Supported | Required | Comments |
|---|---|---|---|
| Search Heads | Yes | Yes | This add-on contains search-time knowledge. It is recommended to turn visibility off on your search heads to prevent data duplication errors that can result from running inputs on your search heads instead of (or in addition to) on your data collection node. |
| Heavy Forwarders | Yes | No (but recommended) | It is recommended to install this add-on on a heavy forwarder for data collection. |
| Indexers | Yes | No | Not required as the parsing operations occur on the forwarders. |
| Universal Forwarders | No | No | Universal forwarders are not supported for data collection because the modular inputs require Python and the Splunk REST handler. |
Configuration
Call Records
Collecting call record data is a 3-step process:
1. Create a Teams Webhook input
Microsoft Teams will push call record header data to Splunk via HTTPS.
- From the add-on, select Inputs > Create New Input > Teams Webhook
- Specify a name for the webhook
- Specify an interval for the webhook - the webhook will run continuously, but the interval will be used for a health check and restart the webhook if necessary.
2. Create a Teams Subscription input
A subscription instructs Microsoft Teams to start sending call record header data to a specified HTTPS webhook.
- From the add-on, select Configuration > Account > Add
- Enter a name, client ID, and client secret for the account
- Required permission for the subscription account =
Subscriptions.Read.All (Delegated) - Select Inputs > Create New Input > Teams Subscription
- Specify an interval for the subscription - 86400 (24 hours) is a typical interval for this field.
- Select an account
- Enter your tenant ID
- Enter the URL for the webhook created above
3. Create a Teams Call Record input
The call record input uses the call record header received by the webhook to retrieve a complete call record from the Teams REST API.
- Select Inputs > Create New Input > Teams Call record
- Specify an interval - specifies how often the input will enumerate call record headers received by the webhook and issue GET requests to the Teams REST API.
- Select an account
- Required permission for the call record account =
CallRecords.Read.All (Application) - Enter your tenant ID
Note: Teams Webhook inputs and Teams Call Record inputs should run on the same system. A load balancer may be used to scale out multiple systems.
Aggregated User Reports
- From the add-on, select Configuration > Account > Add
- Enter a name, client ID, and client secret for the account
- Required permission for the user report account =
Reports.Read.All (Delegated and Application) - Select Inputs > Create New Input > Teams User Report
- Specify an interval for the subscription - 86400 (24 hours) is a typical interval for this field.
- Select an account
- Enter your tenant ID
- Select a report period
Disabling Access
Splunk uses an Azure Active Directory application registration to access Microsoft Teams data. Access to Microsoft Teams data may be disabled from the Azure portal by modifying the Azure Active Directory application registration permissions or removing the Azure Active Directory application.
Privacy
Use of this add-on is permitted subject to your obligations, including data privacy obligations, under your agreement with Splunk and Splunk's Privacy Policy.
Reporting Security Vulnerabilities
Contributors
- Jason Conger
- Skyler Taylor
Third-party software attributions
Refer to the README.txt file included in this package for details.