Home

Splunk Add-on for Microsoft Azure

---

BREAKING CHANGE: version 4.0.0 removed the deprecated event hub input. Use the Splunk Add-on for Microsoft Cloud Services to collect event hub data. Refer to the CHANGELOG for more detail.

---

The Splunk Add-on for Microsoft Azure collects data from Microsoft Azure including the following:

• Azure Active Directory Data
  • Users - Azure AD user data
  • Interactive Sign-ins - Azure AD sign-ins including conditional access policies and MFA
  • Directory audits - Azure AD directory changes including old and new values
  • Devices - Registered devices in Azure AD
  • Groups
  • Risk Detections - Risky users and risk events
• Azure Log Analytics (KQL)
• Metrics
• Estimated billing and consumption
• Inventory metadata
  • Resource Groups - Resource group configuration
  • Virtual Machines - VM, Disk, Image, and Snapshot configurations
  • Virtual Networks - VNET, NSG, and Public IP configurations
  • Subscriptions - Subscription name, ID, and type
  • Topology - IaaS relationships
• Azure Security Center - Alerts and Tasks
• Azure Resource Graph

This add-on contains the following alert actions:

• Stop Azure VM - stops an Azure Virtual Machine.
• Add member to group - adds a user to a group. This can be useful if you need to enable additional policies like MFA based on search results.
• Dismiss Azure Alert - dismisses an Azure Security Center alert.

Note:

Version 3.0.0 and later of the Microsoft Azure Add-on for Splunk is compatible only with Splunk Enterprise version 8.0.0 and above.