Microsoft Defender Advanced Hunting Add-on for Splunk

DEPRECATION NOTICE: THIS IS THE FINAL VERSION OF THIS ADD-ON. THE FUNCTIONALITY HAS BEEN INCORPORATED INTO THE SPLUNK ADD-ON FOR MICROSOFT SECURITY: https://splunkbase.splunk.com/app/6207 This add-on provides field extractions and CIM compatibility for the Endpoint datamodel for Microsoft Defender Advanced Hunting data. The data is similar in content to Sysmon data and can be used by Detection Searches in i.e. Splunk Enterprise Security Content Update. Future versions may include support for Microsoft Defender for Office 365, Microsoft Defender for Identity and other products in the Microsoft 365 suite. Please see the Details tab for more info.