Welcome to the new Splunkbase! To return to the old Splunkbase, click here.
Microsoft Defender Advanced Hunting Add-on for Splunk
This add-on provides field extractions and CIM compatibility for the Endpoint datamodel for Microsoft Defender Advanced Hunting data. The data is similar in content to Sysmon data and can be used by Detection Searches in i.e. Splunk Enterprise Security Content Update. Future versions may include support for Microsoft Defender for Office 365, Microsoft Defender for Identity and other products in the Microsoft 365 suite. Please see the Details tab for more info.
Built by Splunk Works
Latest Version 1.4.1
August 27, 2024
Compatibility
Not Available
Platform Version: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2
CIM Version: 6.x, 5.x, 4.x
Rating
5
(1)
Log in to rate this app
Ranking
#23
in Endpoint
This add-on provides field extractions and CIM compatibility for the Endpoint datamodel for Microsoft Defender Advanced Hunting data.
The data is similar in content to Sysmon data and can be used by Detection Searches in i.e. Splunk Enterprise Security Content Update.
Future versions may include support for Microsoft Defender for Office 365, Microsoft Defender for Identity and other products in the Microsoft 365 suite.
Please see the Details tab for more info.
Categories
Created By
Splunk Works
Contributors
Mikael Bjerkeland
Type
addon
Downloads
15,872
Licensing
Splunk Answers
Resources
Login to report this app listing