Install the Splunk Add-on for Microsoft Security¶
Use this topic to determine where to install the add-on. For general installation procedures, see Installing add-ons.
Distributed deployment locations¶
The following table describes supported installation locations for a distributed Splunk Enterprise deployment:
| Splunk instance type | Supported | Required | Guidance |
|---|---|---|---|
| Search head | Yes | Yes | Install the add-on to provide search-time knowledge and its configuration pages. Configure data collection in only one location to prevent duplicate events. |
| Indexer | Yes | No | Installation is not required when parsing occurs on a heavy forwarder. |
| Heavy forwarder | Yes | No | Recommended data collection tier for distributed deployments. Install and configure the add-on on a heavy forwarder, and use one collection location for each input. |
| Universal forwarder | No | No | Modular inputs require Python and Splunk REST capabilities that a universal forwarder does not provide. |
Note
Splunk Cloud Platform Classic Experience does not support the Defender Advanced Hunting alert action. Configure the action on a supported Splunk Cloud Platform Victoria Experience deployment or on a heavy forwarder.
Installation procedures¶
Choose the procedure that matches your deployment:
- Install an add-on in a single-instance Splunk Enterprise deployment
- Install an add-on in a distributed Splunk Enterprise deployment
- Install an add-on in Splunk Cloud Platform
After installation, configure Microsoft Entra permissions, then configure the add-on.