Skip to content

Troubleshoot the Splunk Add-on for Microsoft Security

Start troubleshooting in Monitoring Dashboard > Internal. Review the MS Security TA Error Monitoring and MS Security TA Performance & Monitoring sections. Set Time for logs to the period that contains the problem. See Monitor the add-on with dashboards for panel details and Microsoft Defender Threat Intelligence filters.

For troubleshooting steps that apply to all supported add-ons, see Troubleshoot add-ons.

Find add-on logs

Search the _internal index for the input name or the add-on log source. For example:

index=_internal source="*Splunk_TA_MS_Security*" (log_level=ERROR OR log_level=WARN)

Increase the logging level only while you reproduce a problem. Return it to its previous setting after collecting the required diagnostics.

Resolve a 403 Forbidden response

A 403 response indicates that Microsoft rejected an authorized request because the application does not have a required role or permission. The log can include a message such as Missing application roles.

  1. Identify the input or alert action that returned the error.
  2. Record the missing permission shown in the error response.
  3. Compare the selected environment and API with the permission reference.
  4. Add the missing Application permission to the Microsoft Entra application.
  5. Grant administrator consent.
  6. Run the input or alert action again.

For the Defender Advanced Hunting alert action in version 5.0.0, grant ThreatHunting.Read.All. The legacy AdvancedHunting.Read.All permission is not sufficient.

Resolve certificate verification errors

Do not disable TLS certificate verification for Microsoft endpoints.

If a Microsoft API request fails with CERTIFICATE_VERIFY_FAILED, verify the following conditions:

  • the host clock is correct
  • the Microsoft endpoint presents a complete and valid certificate chain
  • an intercepting proxy presents a certificate issued by a trusted organizational certificate authority
  • the certificate authority chain is available to the Python runtime used by the add-on

Coordinate custom certificate-authority installation with your Splunk platform administrator. Back up any local trust configuration and reapply it after an add-on upgrade if the deployment process replaces it.

On affected Windows deployments, version 5.0.0 handles the ASN1: NOT_ENOUGH_DATA certificate-store error for unverified loopback connections to the local Splunk REST service. This compatibility handling does not apply to verified connections to Microsoft endpoints.

Resolve missing field extractions

Conflicting knowledge objects from the legacy Microsoft 365 Defender Add-on for Splunk can override extractions from this add-on.

  1. Identify whether the legacy add-on is installed.
  2. Disable its inputs.
  3. Disable the legacy add-on.
  4. Run a search against newly indexed events.
  5. Verify that the expected fields are present.

If the problem continues, confirm that the Splunk Add-on for Microsoft Security is installed on the search head and that its permissions allow users to read the knowledge objects.

Understand duplicate incident-alert events

Duplicate events are expected in the ms365:defender:incident:alerts source type when Microsoft Defender XDR returns unchanged alerts with an updated incident. See Duplicate incident-alert events.

Understand duplicate threat intelligence events

The ms:defender:ti:* source types can contain repeated dataset objects. Use stable Microsoft object identifiers when you deduplicate events in searches.

Recover a missing data interval

Create a temporary input with a start date at the beginning of the missing interval. The input can also collect events that an existing input already indexed, so monitor it and disable it after its checkpoint passes the end of the interval.

  1. Create a temporary input with Start Date set to the beginning of the missing interval in UTC.

  2. Monitor its checkpoint in the input log. For example:

    index=_internal source="*Splunk_TA_MS_Security_Incidents_<input_name>.log" "Updating" "checkpoint"

  3. When the checkpoint is later than the end of the missing interval, disable the temporary input.

  4. Verify the collected event-time range. For example:

    index=<index> sourcetype=<source_type>
| timechart count by createdTime

  5. Deduplicate any events that overlap with the original input.

Input start dates and checkpoint timestamps use Coordinated Universal Time (UTC).

Resolve Event Hub proxy authentication errors

Version 5.0.0 applies the global proxy configuration to both Event Hub authentication and Event Hub data collection. If authentication still fails:

  1. In Configuration > Proxy Configuration, verify the proxy host, port, username, and password.
  2. Verify that the proxy allows HTTPS connections to Microsoft identity endpoints and connections to the configured Event Hubs namespace.
  3. If the proxy host is an IPv6 literal, enter only the address. The add-on adds the required URL brackets.
  4. Save the proxy configuration.
  5. Revalidate or recreate the Event Hub input.

Review the add-on logs for the original Azure Identity or Event Hubs error if the problem continues.