Skip to content

Configure alert actions

The Splunk Add-on for Microsoft Security provides alert actions that run Advanced Hunting queries, update Microsoft Defender incidents, or dismiss Azure subscription-level security alerts.

Available alert actions

Alert action Purpose
Defender Advanced Hunting Run an Advanced Hunting query through Microsoft Graph and index the returned events.
Defender Update Incident Update an incident through the Microsoft 365 Defender API and index the updated incident data.
Defender Update Incident via Graph API Update an incident through Microsoft Graph and index the updated incident data.
Dismiss Azure Alert Dismiss an Azure subscription-level security alert through the Azure Resource Manager API.

Before you configure an alert action

Complete the following prerequisites:

  • Configure a Microsoft Entra application and an add-on account.
  • Grant the permission required by the selected action. See Configure Microsoft Entra permissions.
  • For Defender Advanced Hunting, grant the ThreatHunting.Read.All Microsoft Graph application permission and administrator consent.
  • For Dismiss Azure Alert, assign the Microsoft Entra application an Azure role that includes Microsoft.Security/locations/alerts/dismiss/action for the target subscription. The built-in Security Admin role includes this permission.
  • Configure the action on a search head, a Splunk Cloud Platform Victoria Experience deployment, or a heavy forwarder that can reach the selected Microsoft endpoint.

Note

Splunk Cloud Platform Classic Experience does not support the Defender Advanced Hunting alert action.

Configure an alert action

  1. In Splunk Web, select Settings > Searches, reports, and alerts.
  2. Create a new alert or open an existing alert.
  3. In the alert settings, select Add Actions.
  4. Select one of the alert actions listed in Available alert actions.
  5. Select the add-on account. For Dismiss Azure Alert, explicitly select the account that has access to the target Azure subscription.
  6. If the action displays Environment, select the environment that contains the Microsoft tenant.
  7. If the action displays Tenant ID, optionally enter a tenant ID to override the tenant ID stored with the selected account.
  8. Enter the remaining values required by the selected action.
  9. Save the alert.
  10. Trigger or run the alert and verify its result in Splunk Web.

Configure Defender Advanced Hunting

The Defender Advanced Hunting action uses the following Microsoft Graph hosts:

Environment Microsoft Graph host
Commercial and GCC graph.microsoft.com
GCC High graph.microsoft.us
DoD dod-graph.microsoft.us

Enter a valid Kusto Query Language (KQL) query in Query. The query is required. The action does not expose a Timespan field; Microsoft Graph applies its default query timespan when the request omits that property.

The add-on sends customer KQL unchanged, executes search-result queries sequentially, and validates each response against a 64 MiB decoded-byte ceiling and a 100,000-row ceiling. It does not silently truncate results or introduce an additional query-history cutoff. See Microsoft’s Hunting request contract for provider timespan behavior.

Overall action workload and execution duration also depend on the deployment’s standard Splunk alert/search settings, including maxresults and maxtime in alert_actions.conf. Administrators control these settings, scheduling and concurrency. The add-on does not impose a separate aggregate query-count cap or verify the effective deployment settings. A 60-second HTTP timeout is not an end-to-end wall-clock deadline; ordinary Requests redirect handling is retained. Verify finite platform limits appropriate for the deployment rather than treating unit tests as proof of the installed configuration.

Existing saved actions are mapped to Microsoft Graph environments when version 5.0.0 runs. Previous saved values do not reliably distinguish GCC High from DoD. After upgrading, open each DoD alert action and explicitly select DoD. See Upgrade to version 5.0.0.

Configure Dismiss Azure Alert

The Dismiss Azure Alert action uses the Azure Resource Manager API in the Azure public cloud. It does not support Azure Government or Azure operated by 21Vianet.

Configure the following fields:

Field Description
Select Account The add-on account whose Microsoft Entra application has permission to dismiss alerts in the target subscription. Select an account explicitly so the action does not fall back to the first configured account.
Subscription ID The Azure subscription that contains the security alert. The default token is $result.subscription_id$.
Alert Location The Azure location associated with the security alert, such as eastus or westeurope. The default token is $result.alert_location$.
Alert Name The unique name or identifier of the Azure security alert. The default token is $result.alert_name$.

The search results that trigger the alert must contain values for Subscription ID, Alert Location, and Alert Name, either through the default result tokens or through values that you enter in the action configuration. The action changes the alert state to dismissed; it does not index a new event.

For the Azure permission definition, see Azure permissions for Security. For the built-in role that can dismiss alerts, see Security Admin.