The purpose of this add-on is to provide value to your Microsoft Cloud App Security syslog from Alerts and Activities. This is done by making the logs CIM compliant, adding tagging for Enterprise Security data models, and other knowledge objects to make searching and visualizing this data easy.
This add-on assumes you are onboarding the data either using a syslog collector that outputs to a file or using the built-in Splunk TCP/UDP listener (I would highly recommend the former)--the knowledge objects will work for any ingestion method if you use the correct sourcetype. Regardless of ingestion method, you may need to adjust some of the props.conf settings for proper line breaking and timestamp parsing.
How you choose to bring the syslog data into Splunk is completely up to you. Here are a couple examples of how you might bring on this data:
[tcp://9514]
connection_host = dns
sourcetype = ms:cas:syslog
index = cas
[monitor:///var/log/network/ms_cloud_app_security/*/syslog.log]
sourcetype = ms:cas:syslog
index = cas
disabled = 0
host_segment = 5
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.