Release history¶
Version 5.0.0 is the latest release of the Splunk Add-on for Microsoft Security. It was released on
Version 4.0.0¶
Version 4.0.0 of the Splunk Add-on for Microsoft Security was released on
Version 4.0.0 is compatible with the following software, Common Information Model (CIM) versions, platforms, and vendor products:
| Component | Supported versions or products |
|---|---|
| Splunk platform | 9.3.x, 9.4.x, 10.0.x, 10.2.x |
| Splunk Common Information Model | 8.5.x |
| Operating systems | Windows and Linux |
| Vendor products | Microsoft Defender XDR, Microsoft Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
Version 4.0.0 supports the current Splunk platform field alias behavior. It does not support field alias configurations created for older field alias behavior. See Field alias behavior change in the Splunk Enterprise Release Notes.
New features¶
Version 4.0.0 includes the following new features:
- Observability metrics. The incidents, endpoint alerts, machines, simulations, and Event Hub modular inputs emit observability metrics for collection-health monitoring.
- Configurable query windows. The incidents and endpoint alerts inputs split Microsoft API requests into windows controlled by Max Query Window. The setting helps high-volume tenants avoid oversized requests.
- Retry handling. Microsoft Graph requests retry transient HTTP 500 and 503 responses.
- Checkpoint precision. Checkpoint timestamps normalize subsecond precision to prevent timestamp-rounding gaps or duplicate collection.
- Python 3.13 support. Modular inputs declare support for Python 3.9 and Python 3.13.
Breaking changes¶
Version 4.0.0 includes the following breaking changes:
- Python 3.7 is no longer supported. The minimum supported Python version is 3.9.
- Third-party and development dependencies changed, including the replacement of the legacy modular-input test framework.
Fixed issues¶
Version 4.0.0 of the Splunk Add-on for Microsoft Security fixes the following issues:
Known issues¶
Version 4.0.0 of the Splunk Add-on for Microsoft Security contains the following known issues:
Third-party software attributions¶
Version 4.0.0 incorporates third-party software attributed in the Splunk Add-on for Microsoft Security version 4.0.0 report.
Version 3.0.0¶
Version 3.0.0 of the Splunk Add-on for Microsoft Security was released on
Version 3.0.0 is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.x |
|---|---|
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
-
Enhanced Advanced Hunting event mapping
- Expanded the mapping coverage for Advanced Hunting events to provide broader CIM compatibility.
- Added the event types listed in New event types and the field mapping changes listed in Field mapping changes.
-
Optimized data ingestion efficiency
- Replaced the previous recursive pagination (loading all results into memory) with iterative chunked collection, reducing memory usage, improving performance and stability under rate limits, and enabling earlier incremental checkpoint updates for faster recovery.
-
Lookback option for incident and alert inputs
- Added a configurable lookback parameter that lets administrators define custom query time ranges.
-
Monitoring dashboard
- Added a Monitoring dashboard for operational visibility. The previous metrics and original monitoring dashboard remain available on the Internal tab.
New event types¶
| Source type | Category | Fields added |
|---|---|---|
ms:defender:eventhub |
AdvancedHunting-AlertInfo |
app, id, severity, signature, type, vendor_product |
ms:defender:eventhub |
AdvancedHunting-AlertEvidence |
description, id, severity, type, user, vendor_account |
ms:defender:eventhub |
AdvancedHunting-EmailAttachmentInfo |
file_name, file_create_time, file_hash, action, file_access_time, file_acl, dest, file_path, file_size, vendor_product, process_id, vendor_account |
ms:defender:eventhub |
AdvancedHunting-EmailEvents |
action, internal_message_id, message_id, recipient, recipient_count, recipient_domain, src_user, src_user_domain, subject, vendor_product |
ms:defender:eventhub |
AdvancedHunting-EmailUrlInfo |
action, internal_message_id, url, vendor_product |
ms:defender:eventhub |
AdvancedHunting-IdentityLogonEvents |
action, app, authentication_method, authentication_service, dest, dest_nt_domain, signature, src, src_user_id, vendor_account |
Field mapping changes (Breaking changes)¶
| Source type | Category | Fields modified | 2.5.4 extractions | 3.0.0 extractions | Comments |
|---|---|---|---|---|---|
ms:defender:eventhub |
AdvancedHunting-DeviceRegistryEvents |
dest |
tenantId | DeviceName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-UrlClickEvents |
vendor-product |
DefaultTenant | Microsoft Defender for Endpoint | default value change |
ms:defender:eventhub |
AdvancedHunting-UrlClickEvents |
action |
ClickAllowed | allowed | value change according to Data Model specification when property ClickAllowed is ActionType |
ms:defender:eventhub |
AdvancedHunting-DeviceFileEvents |
file_size |
FileSize/1000 | FileSize/1024 | now calculated in bytes |
ms:defender:eventhub |
AdvancedHunting-DeviceFileEvents |
dest |
tenantId | DeviceName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceImageLoadEvents |
action |
read | allowed | value change according to Data Model specification when property ClickAllowed is ImageLoaded |
ms:defender:eventhub |
AdvancedHunting-DeviceImageLoadEvents |
dest |
tenantId | DeviceName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceImageLoadEvents |
file_size |
FileSize/1000 | FileSize/1024 | now calculated in bytes |
ms:defender:eventhub |
AdvancedHunting-DeviceLogonEvents |
dest |
RemoteIP | DeviceName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
dest |
RemoteIP | DeviceName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
original_file_name |
InitiatingProcessFileName | ProcessVersionInfoOriginalFileName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
parent_process_id |
InitiatingProcessParentId | InitiatingProcessId | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
process |
InitiatingProcessCommandLine | ProcessCommandLine | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
process_exec |
InitiatingProcessFileName | derived from FolderPath | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
process_id |
InitiatingProcessId | ProcessId | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
process_integrity_level |
InitiatingProcessIntegrityLevel | ProcessIntegrityLevel | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
process_name |
InitiatingProcessFileName | FileName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkEvents |
process_path |
InitiatingProcessFolderPath | FolderPath | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceProcessEvents |
action |
created | allowed | value change according to Data Model specification when property ClickAllowed is ProcessCreated |
ms:defender:eventhub |
AdvancedHunting-DeviceProcessEvents |
dest |
TenantId | DeviceName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceProcessEvents |
original_file_name |
FileName | ProcessVersionInfoOriginalFileName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceProcessEvents |
parent_process_exec |
N/A | InitiatingProcessFileName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
dest |
tenantId | DeviceName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
original_file_name |
InitiatingProcessFileName | ProcessVersionInfoOriginalFileName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
parent_process_id |
InitiatingProcessParentId | InitiatingProcessId | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
process |
InitiatingProcessCommandLine | ProcessCommandLine | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
process_exec |
InitiatingProcessFileName | derived from FolderPath | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
process_id |
InitiatingProcessId | ProcessId | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
process_integrity_level |
InitiatingProcessIntegrityLevel | ProcessIntegrityLevel | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
process_name |
InitiatingProcessFileName | FileName | field mapping change |
ms:defender:eventhub |
AdvancedHunting-DeviceEvents |
process_path |
InitiatingProcessFolderPath | FolderPath | field mapping change |
Fixed issues¶
Version 3.0.0 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 3.0.0 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 3.0.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.6.1¶
Version 2.6.1 of the Splunk Add-on for Microsoft Security was released on
Version 2.6.1 is compatible with the following software, CIM versions, and platforms:
| Splunk platform versions | 9.x |
|---|---|
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
Fixed issues¶
Version 2.6.1 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.6.1 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.6.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.6.0¶
Version 2.6.0 of the Splunk Add-on for Microsoft Security was released on September 26, 2025.
Version 2.6.0 is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.1.x, 9.2.x, 9.3.x, 9.4.x |
|---|---|
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
Fixed issues¶
Version 2.6.0 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.6.0 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.6.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.5.4¶
Version 2.5.4 of the Splunk Add-on for Microsoft Security was released on June 24, 2025.
In previous versions, the add-on retrieved incidents through the REST API using the default descending order. When incident volume was high, this led to more than 50 Defender API calls per minute, surpassing the allowed limit. Some incidents during peak periods were missed and, because of the add-on’s internal state and logic, cannot be retrieved retroactively.
In this version, the add-on now retrieves data in ascending order, consistent with most Splunk-supported add-ons. If the Defender API limit is reached, it pauses and then continues retrieving data when allowed.
Version 2.5.4 is compatible with the following software, CIM versions, and platforms:
| Splunk platform versions | 9.1.x, 9.2.x, 9.3.x, 9.4.x |
|---|---|
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
Fixed issues¶
Version 2.5.4 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.5.4 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.5.4 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.5.2¶
Version 2.5.2 of the Splunk Add-on for Microsoft Security was released on June 5, 2025. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.1.x, 9.2.x, 9.3.x, 9.4.x |
|---|---|
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
Fixed issues¶
Version 2.5.2 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.5.2 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.5.2 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.5.1¶
Version 2.5.1 of the Splunk Add-on for Microsoft Security was released on June 5, 2025. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.1.x, 9.2.x, 9.3.x, 9.4.x |
|---|---|
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
Fixed issues¶
Version 2.5.1 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.5.1 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.5.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.5.0¶
Version 2.5.0 of the Splunk Add-on for Microsoft Security was released on April 29, 2025. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.1.x, 9.2.x, 9.3.x, 9.4.x |
|---|---|
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
- Added an input that collects data from the Microsoft List Machines API.
- Added mutual TLS (mTLS) support.
- Added the
ms_security_machinesandms_security_eventhub_url_click_eventevent types.
Known issues¶
Version 2.5.0 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.5.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.4.1¶
Version 2.4.1 of the Splunk Add-on for Microsoft Security was released on December 5, 2024. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.1.x, 9.2.x, 9.3.x |
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
Fixed issues¶
Version 2.4.1 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.4.1 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.4.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.4.0¶
Version 2.4.0 of the Splunk Add-on for Microsoft Security was released on November 25, 2024. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.1.x, 9.2.x, 9.3.x |
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
- Added a modular input that collects Microsoft Defender Threat Intelligence datasets from Microsoft Graph.
Fixed issues¶
Version 2.4.0 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.4.0 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.4.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.3.0¶
Version 2.3.0 of the Splunk Add-on for Microsoft Security was released on July 29, 2024. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.1.x, 9.2.x |
| CIM | 5.3.2 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
Version 2.3.0 of the Splunk Add-on for Microsoft Security has the following new features.
- Added IPv6 support.
Fixed issues¶
Version 2.3.0 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.3.0 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.3.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.2.0¶
Version 2.2.0 of the Splunk Add-on for Microsoft Security was released on April 24, 2024. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.0.x, 9.1.0.x |
| CIM | 5.2.0 |
| Platforms | Windows and Linux |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
Version 2.2.0 of the Splunk Add-on for Microsoft Security has the following new features.
- Added a modular input that collects simulation data from the Microsoft 365 Defender portal.
- Added a modular input that collects Microsoft Defender Advanced Hunting events streamed from the Microsoft 365 Defender portal to Azure Event Hubs.
CIM data model changes¶
There are no CIM data model changes for existing field extractions. The following tables describe the mappings for the modular inputs introduced in version 2.2.0.
Field changes¶
| Source type | Attack type | Fields added | Fields removed |
|---|---|---|---|
ms:defender:simulations |
social | type, user_name, severity, src, app, dest, user, signature, signature_id |
| Source type | Category | Fields added | Fields removed |
|---|---|---|---|
ms:defender:eventhub |
AdvancedHunting-DeviceEvents | parent_process_name, user, parent_process_id, parent_process_path, action, original_file_name, process_exec, process_integrity_level, dest, process_path, vendor_product, process_id, process_hash, process_name, process | |
ms:defender:eventhub |
AdvancedHunting-DeviceFileCertificateInfo | ssl_validity_window, src, ssl_issuer_common_name, dest, ssl_serial, ssl_subject_common_name, ssl_subject_organization, ssl_hash, ssl_start_time, ssl_signature_algorithm, ssl_end_time | |
ms:defender:eventhub |
AdvancedHunting-DeviceFileEvents | file_name, file_create_time, file_hash, action, file_access_time, file_acl, dest, file_path, file_size, vendor_product, process_id, user | |
ms:defender:eventhub |
AdvancedHunting-DeviceImageLoadEvents | file_name, file_hash, action, file_access_time, file_acl, dest, file_size, file_path, vendor_product, process_id, user | |
ms:defender:eventhub |
AdvancedHunting-DeviceInfo | family, version, os, dest, vendor_product | |
ms:defender:eventhub |
AdvancedHunting-DeviceLogonEvents, AdvancedHunting-DeviceNetworkEvents | parent_process_name, user, parent_process_id, parent_process_path, action, original_file_name, process_exec, process_integrity_level, dest, process_path, vendor_product, process_id, process_hash, process_name, process | |
ms:defender:eventhub |
AdvancedHunting-DeviceNetworkInfo | mac, src_ip, name, ip, dest, interface, vendor_product, dns, status | |
ms:defender:eventhub |
AdvancedHunting-DeviceProcessEvents | parent_process_name, user, parent_process_id, parent_process_path, action, parent_process, original_file_name, process_exec, process_integrity_level, dest, process_path, vendor_product, process_id, process_name, process | |
ms:defender:eventhub |
AdvancedHunting-DeviceRegistryEvents | action, registry_path, dest, registry_key_name, registry_hive, process_id, registry_value_type, vendor_product, registry_value_name, user |
Note
This version adds field mappings for the new modular inputs. It does not remove any field mappings.
Fixed issues¶
Version 2.2.0 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.2.0 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.2.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.1.1¶
Version 2.1.1 of the Splunk Add-on for Microsoft Security was released on July 13, 2023. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.0.x |
| CIM | 5.0.1 |
| Platforms | Platform independent |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
CIM data model changes¶
There are no CIM data model changes between the Splunk add-on for Microsoft Security v2.1.0 and v2.1.1.
Fixed issues¶
Version 2.1.1 of the Splunk Add-on for Microsoft Security contains the following fixed issues.
Known issues¶
Version 2.1.1 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.1.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.1.0¶
Version 2.1.0 of the Splunk Add-on for Microsoft Security was released on June 13, 2023. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 9.0.x |
| CIM | 5.0.1 |
| Platforms | Platform independent |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
Version 2.1.0 of the Splunk Add-on for Microsoft Security has the following new features.
- Added dashboards that provide operational information, errors, and recommended actions.
- Added support for configuring the add-on from a deployment server.
- Added a warning when an administrator creates an input with duplicate values.
CIM data model changes¶
There are no CIM data model or field extraction changes between versions 2.0.1 and 2.1.0 of the Splunk Add-on for Microsoft Security.
Fixed issues¶
Version 2.1.0 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.1.0 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.1.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 2.0.1¶
Version 2.0.1 of the Splunk Add-on for Microsoft Security was released on April 14, 2023. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 8.1.x, 8.2.x, 9.0.x |
| CIM | 5.0.1 |
| Platforms | Platform independent |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
Version 2.0.1 of the Splunk Add-on for Microsoft Security has the following new features.
- Added Microsoft Graph API support for collecting incidents and alerts.
- Added Microsoft Graph API support for updating incidents and running Advanced Hunting queries.
- Updated the input and configuration pages.
- Added a default tenant ID value to the account configuration.
- Added CIM mappings for data collected through Microsoft Graph.
CIM data model changes¶
There are no changes to existing CIM data model mappings between versions 1.3.1 and 2.0.1. Version 2.0.1 adds the following mappings.
Field changes¶
| Source type | Category | Fields added | Fields removed |
|---|---|---|---|
ms:defender:atp:alerts |
LateralMovement, Discovery, PrivilegeEscalation, SuspiciousActivity, DefenseEvasion, Collection, CredentialAccess, Execution, CommandAndControl, InitialAccess | signature_id | |
ms:defender:atp:alerts |
None, Persistence | signature_id, user |
| Source type | threatFamilyName |
Fields added | Fields removed |
|---|---|---|---|
ms365:defender:incident:alerts |
null | signature_id |
Note
The add-on no longer extracts values such as null for the signature_id and user fields. There are no field changes for the m365:defender:incident:advanced_hunting source type.
Fixed issues¶
Version 2.0.1 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 2.0.1 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 2.0.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 1.3.1¶
Version 1.3.1 of the Splunk Add-on for Microsoft Security was released on October 13, 2022. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 8.1, 8.2, 9.0 |
| CIM | 5.0.1 |
| Platforms | Platform independent |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
Version 1.3.1 of the Splunk Add-on for Microsoft Security has the following new features.
- Changed the event type name prefix from
ms_defendertoms_security.
| Previous event type name | New event type name |
|---|---|
| ms_defender_incident | ms_security_incident |
| ms_defender_atp_alert | ms_security_atp_alert |
| ms_defender_advanced_hunting_sourcetypes | ms_security_advanced_hunting |
| ms_defender_advanced_hunting_process. | ms_security_advanced_hunting_process |
| ms_defender_advanced_hunting_filesystem | ms_security_advanced_hunting_filesystem |
| ms_defender_advanced_hunting_registry | ms_security_advanced_hunting_registry |
| ms_defender_advanced_hunting_delivery | ms_security_advanced_hunting_delivery |
| ms_defender_advanced_hunting_email | ms_security_advanced_hunting_email |
| ms_defender_advanced_hunting_authentication | ms_security_advanced_hunting_authentication |
| ms_defender_incident_alerts | ms_security_incident_alerts |
- Added the
hostfield to events ingested through alert actions. - Updated the system path to prioritize the add-on’s third-party libraries during data collection.
- Improved input validation.
- Added the Tenant ID field to the alert action configuration.
- Added an account selector to the alert action configuration.
- Updated
_timeextraction for thems:defender:atp:alertsandms365:defender:incident:alertssource types. The add-on now uses the event’s last update time.
Fixed issues¶
Version 1.3.1 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 1.3.1 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 1.3.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 1.2.0¶
Version 1.2.0 of the Splunk Add-on for Microsoft Security was released on March 23, 2022. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 8.1, 8.2 |
| CIM | 5.0.0 |
| Platforms | Platform independent |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
Version 1.2.0 of the Splunk Add-on for Microsoft Security has the following new features.
- Added support for GCC and GCC High environments. Administrators with credentials for these environments can collect their data.
- Updated the
defender_update_incidentalert action. - Added support for CIM version 5.0.0.
Fixed issues¶
Version 1.2.0 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 1.2.0 of the Splunk Add-on for Microsoft Security contains the following known issues.
Third-party software attributions¶
Version 1.2.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.
Version 1.1.0¶
Version 1.1.0 of the Splunk Add-on for MS Security was released on January 24, 2021. It is compatible with the following software, CIM versions, and platforms.
| Splunk platform versions | 8.1, 8.2 |
| CIM | 4.20.2 |
| Platforms | Platform independent |
| Vendor products | Microsoft 365 Defender, Defender for Endpoint |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
New features¶
Version 1.1.0 of the Splunk Add-on for Microsoft Security has the following new features.
- Introduced the Splunk Add-on for Microsoft Security as the successor to the Microsoft 365 Defender Add-on for Splunk.
- Renamed the
m365:defender:incidentsource type toms365:defender:incidentand mapped it to the Ticket Management Incident data model instead of the Alerts data model. - Enhanced CIM field mappings for the
ms:defender:atp:alertsandm365:defender:incident:advanced:huntingsource types. - Added the
ms365:defender:incident:alertssource type. During index-time processing, the add-on separates alert data from incident data. It indexes alert data asms365:defender:incident:alertsand incident data asms365:defender:incident. - Removed the
alert_queue,incident_queue,overview_alert,overview_detections,advanced_hunting,incident_detail,incident_overview,incident_update, andmicrosoft_defender_atp_alertsdashboard panels. - Added support for CIM version 4.20.2.
Fixed issues¶
Version 1.1.0 of the Splunk Add-on for Microsoft Security fixes the following issues.
Known issues¶
Version 1.1.0 of the Splunk Add-on for MS Security contains the following known issues.
Third-party software attributions¶
Version 1.1.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.