Overview

Splunk Add-on for Microsoft Security

Property	Value
Version	5.0.0
Vendor products	Microsoft Defender XDR, Microsoft Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence
Visible in Splunk Web	Yes. The add-on includes configuration pages.

The Splunk Add-on for Microsoft Security collects security incidents, incident alerts, endpoint alerts, machine inventory, attack simulation reports, Advanced Hunting events, and Microsoft Defender Threat Intelligence datasets.

The add-on supports the following collection paths:

• Microsoft Defender and Microsoft Graph APIs for scheduled modular inputs
• Azure Event Hubs for near-real-time Microsoft Defender XDR streaming events
• a Microsoft Graph alert action for ad hoc Advanced Hunting queries
• alert actions that update Microsoft Defender incidents and index the updated incident data

Before you install the add-on, review the hardware and software requirements and the installation and configuration overview.

Download the Splunk Add-on for Microsoft Security from Splunkbase.

Hardware and software requirements

Review the following requirements before you install and configure the Splunk Add-on for Microsoft Security.

Microsoft requirements

Create a Microsoft Entra application registration for the add-on. You need its tenant ID, client ID, and client secret to configure an account.

Assign only the application permissions and Azure roles required by the inputs and alert actions that you use. See Configure Microsoft Entra permissions for the permission matrix and configuration steps.

For Azure Event Hubs collection, configure a namespace, event hub, consumer group, and an identity that has the Azure Event Hubs Data Receiver role.

Python requirements

The add-on supports Python 3.9 and Python 3.13. Python 3.7 is not supported in version 4.0.0 or later.

On Windows Server 2022 with Splunk Enterprise 10.4.4, forcing Python 3.9 for the Event Hub input can cause its process to crash. Use the default Python 3.13 configuration on that platform. See the known issue and workaround.

Splunk platform requirements

Version 5.0.0 supports Splunk platform versions 9.4.x, 10.0.x, 10.2.x, 10.4.x, 10.6.x, and 10.7.x. The host operating system and hardware must meet the requirements for the Splunk platform version that runs the add-on.

See System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual.

Network requirements

Allow outbound HTTPS connections on TCP port 443 to the Microsoft endpoints used by your configured inputs and alert actions.

If you collect data from Azure Event Hubs, also allow the required Azure Event Hubs transport ports. See What ports do I need to open on the firewall? in the Microsoft documentation.

IPv6-only hosts require working IPv6 name resolution and connectivity to the selected Microsoft endpoint. If an Azure Event Hubs fully qualified domain name (FQDN) does not resolve to IPv6, provide DNS64 and NAT64 in your network infrastructure.

Installation and configuration overview

Complete these tasks to install and configure the Splunk Add-on for Microsoft Security:

1. Review the hardware and software requirements.
2. Download the add-on from Splunkbase.
3. Install the add-on on the appropriate Splunk platform tier.
4. Configure Microsoft Entra permissions.
5. Configure an account and inputs.
6. Optional: Configure alert actions.
7. Validate data collection.

If you are upgrading an existing deployment, review Migrate and upgrade before you install version 5.0.0.

Ended: Overview

Installation

Install the Splunk Add-on for Microsoft Security

Use this topic to determine where to install the add-on. For general installation procedures, see Installing add-ons.

Distributed deployment locations

The following table describes supported installation locations for a distributed Splunk Enterprise deployment:

Splunk instance type	Supported	Required	Guidance
Search head	Yes	Yes	Install the add-on to provide search-time knowledge and its configuration pages. Configure data collection in only one location to prevent duplicate events.
Indexer	Yes	No	Installation is not required when parsing occurs on a heavy forwarder.
Heavy forwarder	Yes	No	Recommended data collection tier for distributed deployments. Install and configure the add-on on a heavy forwarder, and use one collection location for each input.
Universal forwarder	No	No	Modular inputs require Python and Splunk REST capabilities that a universal forwarder does not provide.

Note

Splunk Cloud Platform Classic Experience does not support the Defender Advanced Hunting alert action. Configure the action on a supported Splunk Cloud Platform Victoria Experience deployment or on a heavy forwarder.

Installation procedures

Choose the procedure that matches your deployment:

• Install an add-on in a single-instance Splunk Enterprise deployment
• Install an add-on in a distributed Splunk Enterprise deployment
• Install an add-on in Splunk Cloud Platform

After installation, configure Microsoft Entra permissions, then configure the add-on.

Migrate and upgrade the Splunk Add-on for Microsoft Security

Review every section between your installed version and the target version before you upgrade.

Upgrade to version 5.0.0

Version 5.0.0 moves the Defender Advanced Hunting alert action from the legacy Microsoft Defender XDR endpoint to Microsoft Graph POST /v1.0/security/runHuntingQuery. Complete the permission change before you upgrade so scheduled alerts can continue to run.

Prepare the Microsoft Graph permission

1. Identify the Microsoft Entra application used by each Defender Advanced Hunting alert action.
2. Add the Microsoft Graph Application permission ThreatHunting.Read.All.
3. Grant administrator consent for ThreatHunting.Read.All.
4. Keep the legacy AdvancedHunting.Read.All permission until you validate every migrated alert action.

The Advanced Hunting query remains required. The alert action does not expose a Timespan field. When the request omits Timespan, Microsoft Graph applies its default 30-day timespan.

Upgrade and validate alert actions

1. Upgrade the Splunk Add-on for Microsoft Security to version 5.0.0.
2. Open every saved alert that uses Defender Advanced Hunting.
3. Confirm that the selected Environment matches the Microsoft tenant.
4. For each DoD tenant, explicitly select DoD.
5. Save the alert.
6. Run a test query and verify that the returned events use the m365:defender:incident:advanced_hunting source type.
7. Review the alert-action log for authorization, endpoint, or query errors.
8. For each migrated alert action, inspect the outbound HTTP request trace for its test execution. Confirm that the TA calls Microsoft Graph POST /v1.0/security/runHuntingQuery on the host for the selected environment and no longer calls the legacy /api/advancedhunting/run endpoint. If the trace does not show the request path, obtain that evidence before removing the legacy permission.
9. After every action succeeds and endpoint verification is complete, remove AdvancedHunting.Read.All if no other application workload requires it.

Version 5.0.0 maps existing saved environment values as follows:

Saved value	Environment in version 5.0.0	Microsoft Graph host
Missing, default, commercial, or gcc	Commercial and GCC	graph.microsoft.com
gcc-high	GCC High	graph.microsoft.us
commercial-graph-api	Commercial and GCC	graph.microsoft.com
gcc-high-graph-api	GCC High	graph.microsoft.us
dod-graph-api	DoD	dod-graph.microsoft.us

Warning

Previous saved values do not reliably distinguish GCC High from DoD. You must explicitly select DoD after upgrading each DoD alert action. Otherwise, the action sends its request to graph.microsoft.us instead of dod-graph.microsoft.us.

Microsoft publishes service retirement information in Microsoft 365 Message Center notice MC1220762.

Review CIM mapping changes

Version 5.0.0 changes the following Common Information Model (CIM) fields:

Source type and event	Change	Upgrade impact
ms:defender:machines	The source type now maps to the Inventory Network dataset and adds scalar CIM ip and mac fields. ip uses lastIpAddress, then lastExternalIpAddress. mac uses the corresponding nonzero MAC address in lowercase, colon-delimited format.	The ip and mac fields are new in version 5.0.0. The existing private_ipv4 and public_ipv4 fields remain available for IPv4 values. Raw multivalue ipAddresses{}.ipAddress and ipAddresses{}.macAddress fields remain in each event.
ms:defender:eventhub with AdvancedHunting-DeviceFileCertificateInfo	dest uses properties.DeviceName when present.	Searches that used dest as a tenant identifier must use tenantId.
m365:defender:incident:advanced_hunting and ms:defender:eventhub with DeviceNetworkEvents and ActionType=ConnectionFailed	action is flow instead of blocked.	Searches, dashboards, and alerts based on Network_Traffic.Blocked_Traffic can return fewer events.
ms:defender:atp:alerts	In version 4.0.0, src used serviceSource first and fell back to computerDnsName. In version 5.0.0, src uses computerDnsName first and falls back to the first nonempty evidence{}.deviceDnsName value. serviceSource no longer populates src.	Use serviceSource directly when a search requires the Microsoft product value. Review searches that depend on the previous src precedence.
Authentication events in m365:defender:incident:advanced_hunting	signature_id uses the stable ActionType instead of the per-event ReportId_string.	Use ReportId_string when a search requires the individual event identifier.
m365:defender:incident:advanced_hunting with IdentityLogonEvents	app uses a nonempty Application other than the literal null, with the existing ms:defender fallback otherwise.	Review searches that filter on app=ms:defender. Use the source type or an appropriate vendor_product filter to identify product events, and app to identify the authenticating application.
m365:defender:incident:advanced_hunting and ms:defender:eventhub filesystem timestamps; Event Hub certificate timestamps	file_access_time, file_create_time, file_modify_time, ssl_start_time, and ssl_end_time use numeric Unix epoch seconds, including fractional seconds at Splunk’s available numeric precision. Invalid or missing source values leave the mapped field unset.	Review searches that treated these fields as ISO8601 strings. Use strftime() when a formatted date is needed. Existing event and action conditions remain unchanged.
ms365:defender:incident	time_submitted uses the first valid creation time from createdDateTime, then legacy createdTime, as numeric Unix epoch seconds. Update times no longer populate this field.	Searches that require the last update time must use lastUpdateDateTime or lastUpdateTime directly. Invalid or missing creation times leave time_submitted unset.
m365:defender:incident:advanced_hunting	process_id uses InitiatingProcessId for DeviceFileEvents and DeviceRegistryEvents, and ProcessId for other events. Numeric source values produce a numeric ID; missing, empty, literal null, and nonnumeric values leave the field unset.	Review searches that tested process_id for the literal string null. File and registry events now expose the available initiating actor ID.
Graph and Event Hub DeviceFileEvents and DeviceRegistryEvents	process and process_name use the initiating process command line and file name from InitiatingProcessCommandLine and InitiatingProcessFileName.	Review searches that used these process fields to identify the affected object. Use the corresponding file or registry fields for the object.
Graph and Event Hub DeviceFileEvents and DeviceRegistryEvents	process_path and process_exec describe the initiating process, using InitiatingProcessFolderPath and InitiatingProcessFileName. Graph process_hash contains the available named MD5, SHA1, and SHA256 actor hashes. Event Hub process_hash selects the first available actor hash: SHA256, then SHA1, then MD5. Missing, empty, and literal null actor values leave the corresponding fields unset.	Review searches that used these process fields for the affected file. Use the existing file or registry fields and unchanged raw source fields for the affected object. Other event families retain their existing mappings.
Graph DeviceFileEvents and DeviceRegistryEvents parent fields	parent_process_id uses numeric InitiatingProcessParentId; parent_process_name and parent_process_exec use InitiatingProcessParentFileName. Missing or invalid parent values remain unset. Parent command line, path, hash, and GUID fields are omitted because the available source columns describe the initiating actor instead of its parent.	Review searches that relied on the initiating actor being duplicated as its own parent. Use the available parent PID and executable name. Other Graph datasets and Event Hub parent mappings retain their existing behavior.
Graph and Event Hub DeviceFileEvents and DeviceRegistryEvents integrity level	process_integrity_level uses the available InitiatingProcessIntegrityLevel. Graph preserves the source casing; Event Hub uses lowercase values, following each transport’s existing convention. Missing, empty, and source null or none values leave the field unset.	These events now expose the initiating actor’s integrity level instead of using an unrelated or unavailable target-process value. Other event families retain their existing mappings.
Graph and Event Hub DeviceFileEvents, DeviceImageLoadEvents, and EmailAttachmentInfo	The multivalue file_hashes field contains the available nonempty MD5, SHA1, and SHA256 source hashes. The existing file_hash field remains available.	Searches that need every available hash can use file_hashes; existing searches that use file_hash can keep that field.
Graph DeviceProcessEvents	When ProcessCommandLine begins with an absolute executable path, process uses that command line without prepending the path again. Other command lines retain the existing reconstruction behavior.	Review searches that depended on the duplicated path. The source command line remains unchanged.
m365:defender:incident:advanced_hunting with DeviceNetworkEvents	src, src_ip, dest, and dest_ip omit missing, empty, JSON-null, and literal null addresses. Genuine IPv4 and IPv6 values keep their source and destination roles.	Use isnull() when testing for an unavailable address. The literal string null no longer identifies an endpoint. Other event families retain their existing mappings.
m365:defender:incident:advanced_hunting with DeviceFileEvents	CIM file_size is numeric kilobytes, converted from Microsoft FileSize bytes. Zero and fractional kilobytes are preserved; missing or nonnumeric source values leave the field unset.	Review thresholds and calculations that assumed file_size contained bytes. Use the unchanged source FileSize when bytes are needed. Event Hub file/image mappings remain kilobytes, and Event Hub email attachment size fields remain bytes.
ms:defender:eventhub with AdvancedHunting-DeviceInfo or AdvancedHunting-DeviceNetworkInfo	CIM enabled is no longer derived from Defender onboarding or adapter operational status. These strings do not establish the optional CIM boolean resource-enabled state.	Searches that used enabled=Onboarded or enabled=Down must use the unchanged properties.OnboardingStatus or properties.NetworkAdapterStatus source fields. The existing status mapping remains sensor health for DeviceInfo and adapter operational status for DeviceNetworkInfo. Genuine source enabled values are not suppressed.
ms:defender:simulations	src and dest no longer contain static product or portal names.	The fields remain unset because the current payload does not contain a meaningful source or destination host or IP address.

Explicit-zone ISO8601 timestamps with four-digit years from 0001 through 9999 convert to Unix epoch seconds. The mappings retain native strptime() results where supported and use calendar-equivalent years for valid dates outside its range. Existing numeric epoch values, including 0, remain supported. Contemporary fractional timestamps retain the native parser’s microsecond precision; fractional precision can be lower at very large absolute epoch values because Splunk stores the result as a floating-point number.

Version 5.0.0 also adds the multivalue detection_status field for available alert-evidence detectionStatus values.

Clarification of historical gateway mappings

The version 2.2.0 mapping table listed src_ip for Event Hub DeviceNetworkInfo gateway addresses. Gateway handling is unchanged between versions 4.0.0 and 5.0.0. Use the preserved properties.DefaultGateways source data for gateway information; a gateway address does not necessarily identify the originating system described by CIM src_ip. DeviceNetworkEvents continues to populate src_ip from properties.LocalIP.

To inspect Event Hub gateway addresses without assigning them the CIM source-IP role, extract the preserved JSON array:

sourcetype=ms:defender:eventhub category=AdvancedHunting-DeviceNetworkInfo
| spath input=properties.DefaultGateways path={} output=default_gateway
| table _time properties.DeviceName default_gateway

Upgrade to version 4.0.0

Version 4.0.0 removes Python 3.7 support. Verify that the Splunk platform deployment uses Python 3.9 or Python 3.13 before you upgrade.

Version 4.0.0 adds the following optional settings to the Microsoft 365 Defender Incidents and Microsoft Defender for Endpoint Alerts inputs:

• Lookback delays the end of collection to allow data to arrive. The upper bound is the current UTC time minus this value; collection resumes from its checkpoint. The value is in seconds, must be less than Interval, and defaults to 0.
• Max Query Window limits the number of days in one Microsoft API query window for both Microsoft Graph and legacy Defender API environments. The valid range is 1 through 30, and the default is 7. Use a smaller value for high-volume tenants.

Existing inputs use the default values until you change them.

Upgrade from version 2.1 to version 2.2.0 or later

After upgrading, clear the browser cache and reload the add-on. Version 2.2.0 adds inputs for attack simulations and real-time Advanced Hunting events streamed through Azure Event Hubs.

Upgrade from version 2.0.1 to version 2.1.1

After upgrading, clear the browser cache and reload the add-on to display the monitoring dashboards.

Upgrade from version 1.3.1 to version 2.0.1

After upgrading, clear the browser cache before you open the add-on.

Migrate from the Microsoft 365 Defender Add-on for Splunk

Disable the legacy Microsoft 365 Defender Add-on for Splunk before you enable the Splunk Add-on for Microsoft Security on the same Splunk platform instance. Running both add-ons can duplicate data and create conflicting knowledge objects.

1. In the legacy add-on, disable every input.
2. In Splunk Web, select Apps > Manage Apps.
3. Find Microsoft 365 Defender Add-on for Splunk.
4. Select Disable.
5. Install and configure the Splunk Add-on for Microsoft Security.
6. Verify the new source names and source types before enabling scheduled searches.

Source-name changes

Legacy source name	Splunk Add-on for Microsoft Security source name
microsoft_365_defender_incidents	microsoft_365_defender_endpoint_incidents
microsoft_defender_atp_alerts	microsoft_defender_endpoint_atp_alerts
ms_defender_apt_alerts	ms_defender_endpoint_apt_alerts

Event-type and data-model changes

Event type	Legacy CIM mapping	Current CIM mapping
ms_security_incident	Alerts	Ticket Management: Incident
ms_security_atp_alert	Alerts	Alerts
ms_security_advanced_hunting	None	None
ms_security_advanced_hunting_process	Endpoint: Processes	Endpoint: Processes
ms_security_advanced_hunting_network	Network Traffic, Endpoint: Ports	Removed. Network events use ms_security_advanced_hunting_network_traffic.
ms_security_advanced_hunting_filesystem	Change: Endpoint, Endpoint: Filesystem	Endpoint: Filesystem
ms_security_advanced_hunting_registry	Change: Endpoint, Endpoint: Registry	Endpoint: Registry
ms_security_advanced_hunting_delivery	None	Email: Delivery
ms_security_advanced_hunting_email	None	Email
ms_security_advanced_hunting_authentication	None	Authentication
ms_security_incident_alerts	None	Alerts

The current add-on separates incident data and associated alert data into ms365:defender:incident and ms365:defender:incident:alerts. The legacy m365:defender:incident source type contained both kinds of data.

The add-on can collect alerts directly in ms:defender:atp:alerts or as incident-associated alerts in ms365:defender:incident:alerts. The Microsoft APIs return different schemas for these collection paths. Choose the input and source type that provide the fields required by your searches.

Configure Microsoft Entra permissions

Create a Microsoft Entra application registration and grant only the permissions required by the inputs and alert actions that you use. Configure permissions as Application permissions, not Delegated permissions.

Permission reference

The following table maps add-on capabilities to Microsoft API permissions or Azure roles:

Capability	Source type	Required permission or role	Component
Collect incidents and their alerts by using the Microsoft 365 Defender API	ms365:defender:incident, ms365:defender:incident:alerts	Incident.Read.All	Modular input
Collect incidents and their alerts by using Microsoft Graph	ms365:defender:incident, ms365:defender:incident:alerts	SecurityIncident.Read.All	Modular input
Collect endpoint alerts by using the Microsoft Defender for Endpoint API	ms:defender:atp:alerts	Alert.Read.All	Modular input
Collect endpoint alerts by using Microsoft Graph	ms:defender:atp:alerts	SecurityAlert.Read.All	Modular input
Collect Microsoft Defender for Endpoint machine inventory	ms:defender:machines	Machine.Read.All	Modular input
Update incidents by using the Microsoft 365 Defender API	ms365:defender:incident, ms365:defender:incident:alerts	Incident.ReadWrite.All	Alert action
Update incidents by using Microsoft Graph	ms365:defender:incident, ms365:defender:incident:alerts	SecurityIncident.ReadWrite.All	Alert action
Run Defender Advanced Hunting queries	m365:defender:incident:advanced_hunting	ThreatHunting.Read.All	Alert action
Collect attack simulation reports	ms:defender:simulations	AttackSimulation.Read.All	Modular input
Collect streamed Advanced Hunting events from Azure Event Hubs	ms:defender:eventhub	Azure Event Hubs Data Receiver	Modular input
Collect Microsoft Defender Threat Intelligence datasets	ms:defender:ti:*	ThreatIntelligence.Read.All	Modular input
Dismiss an Azure subscription-level security alert	Not applicable	Security Admin, or a custom Azure role that includes Microsoft.Security/locations/alerts/dismiss/action	Alert action

Important

In version 5.0.0, the Defender Advanced Hunting alert action uses Microsoft Graph only. The legacy AdvancedHunting.Read.All permission does not authorize this action. Add ThreatHunting.Read.All and grant administrator consent before you upgrade.

Add API permissions

You need a Microsoft Entra role that can manage application permissions. An application owner can add requested permissions, but an administrator must grant tenant-wide consent.

1. Sign in to the Microsoft Entra admin center.
2. Go to Identity > Applications > App registrations > All applications.
3. Select the application registration that the add-on uses.
4. Select API permissions.
5. Select Add a permission.
6. Select the API used by your input or alert action.
7. Select Application permissions.
8. Select the permissions from the permission reference.
9. Select Add permissions.
10. Select Grant admin consent and confirm the action.
11. Verify that the status for each required permission is Granted.

For the Microsoft Graph permission definitions, see the Microsoft Graph permissions reference. For ThreatHunting.Read.All, see Run hunting query. For the Microsoft Defender for Endpoint permission, see List machines API.

Assign the Azure Event Hubs role

The Microsoft Defender Event Hub input uses an Azure role instead of a Microsoft Graph application permission.

1. In the Azure portal, open the Event Hubs namespace or event hub that the add-on uses.
2. Select Access control (IAM).
3. Add a role assignment for Azure Event Hubs Data Receiver.
4. Assign the role to the identity represented by the add-on’s Microsoft Entra application.
5. Verify the assignment before you configure the input.

For information about configuring Microsoft Defender XDR streaming, see Stream data from Microsoft Defender XDR to Event Hubs.

Assign permission to dismiss Azure alerts

The Dismiss Azure Alert action uses Azure role-based access control instead of a Microsoft Graph application permission.

1. In the Azure portal, open the subscription that contains the security alerts.
2. Select Access control (IAM).
3. Add a role assignment for Security Admin, or assign a custom role that includes Microsoft.Security/locations/alerts/dismiss/action.
4. Assign the role to the service principal for the Microsoft Entra application configured as the add-on account.
5. Verify the assignment before you configure the alert action.

Grant the role at the narrowest scope that contains the alerts the action must dismiss. See Azure permissions for Security and Security Admin in the Microsoft documentation.

Ended: Installation

Configuration

Configure accounts and inputs

Configure a Microsoft Entra account, an optional proxy, and at least one input before the Splunk Add-on for Microsoft Security can collect data.

Configure an account

Before you add an account, create a Microsoft Entra application and grant the required permissions.

1. In the add-on, select Configuration > Account.
2. Select Add.
3. Enter a unique Account Name that starts with an ASCII letter and contains only ASCII letters, digits, and underscores.
4. Enter the application’s Client ID.
5. Enter the application’s Client Secret.
6. Enter the Microsoft Entra Tenant ID as a tenant GUID or tenant domain name.
7. Select Add.

An input or alert action can override the tenant ID stored with the account.

New account names have a maximum length of 50 characters. New input names have a maximum length of 100 characters and follow the same naming rules. These rules are enforced when creating entries through Splunk Web or the add-on REST endpoints. New configuration-file deployments should follow the same rules.

Existing configuration is not rewritten automatically. The add-on REST edit path preserves unchanged safe legacy names containing letters, numbers, underscores, spaces, dots or hyphens, subject to Splunk’s reserved-name rules and 1023-character limit. For example, an account named prod-account can keep its name when its client secret is rotated. Account references and input checkpoint identities are not renamed. Names containing markup, URL delimiters or control characters remain unsupported for ordinary edits; tenant and proxy-host values must still meet their validation rules.

Existing inputs can still be enabled or disabled without changing their configuration, including inputs with legacy names that do not meet these naming rules.

Configure a proxy

Configure one global proxy for Microsoft API and Azure Event Hubs connections. Version 5.0.0 applies this proxy configuration to Event Hub authentication as well as data collection.

1. In the add-on, select Configuration > Proxy Configuration.
2. Select Enable Proxy.
3. Enter the proxy host in Proxy Host. Do not include a URL scheme or path.
4. Enter the proxy port in Proxy Port.
5. Optional: Enter Proxy Username and Proxy Password for an authenticated proxy.
6. Save the configuration.

For Event Hub connections that use an IPv6 proxy literal, enter the address without square brackets. The Event Hub connection code adds the brackets required in the proxy URL. Other Microsoft API inputs do not add IPv6 brackets automatically, so use a proxy host name for those inputs.

Configure an input

1. In the add-on, select Inputs.
2. Select Create New Input.
3. Select an input type.
4. Enter the common and input-specific values described in this topic.
5. Select Add.
6. Search the target index to verify data collection.

Common input settings

Most inputs use the following settings:

Setting	Description
Name	A unique name for the input.
Azure App Account	The account configured on the Account page.
Tenant ID	An optional tenant ID that overrides the value stored with the account.
Start Date (optional)	The beginning of data collection in Coordinated Universal Time (UTC), in YYYY-MM-DDTHH:MM:SSZ format. If empty, the input starts 30 days before its first run.
Request Timeout (optional)	The Microsoft request timeout in seconds. The default is 60 seconds. Version 5.0.0 also applies this default to legacy configurations where the value is empty or missing.
Interval	The collection interval in seconds.
Index	The destination Splunk index.

Select an environment or location that matches the Microsoft tenant and API permissions. A Microsoft 365 Defender API permission does not authorize a Microsoft Graph input, and a Microsoft Graph permission does not authorize a legacy API input.

Microsoft 365 Defender Incidents

Configure these additional settings:

Setting	Description
Environment	The Microsoft 365 Defender or Microsoft Graph environment that contains the tenant.
Lookback (optional)	The number of seconds to delay the end of collection to allow data to arrive. The upper bound is the current UTC time minus this value; collection resumes from its checkpoint. The value must be less than Interval. The default is 0.
Max Query Window (days, optional)	The maximum number of days in one Microsoft API query window. Use a smaller value for high-volume tenants. The valid range is 1 through 30, and the default is 7.

The Graph input saves a checkpoint only after it processes every page in a query window. If a later page fails, the next run retries the incomplete window.

Microsoft Defender for Endpoint Alerts

Configure these additional settings:

Setting	Description
Location	The Microsoft Defender for Endpoint or Microsoft Graph location that contains the tenant.
Lookback (optional)	The number of seconds to delay the end of collection to allow data to arrive. The upper bound is the current UTC time minus this value; collection resumes from its checkpoint. The value must be less than Interval. The default is 0.
Max Query Window (days, optional)	The maximum number of days in one Microsoft API query window. Use a smaller value for high-volume tenants. The valid range is 1 through 30, and the default is 7.

The Graph input saves a checkpoint only after it processes every page in a query window. If a later page fails, the next run retries the incomplete window.

Microsoft Defender Machines

Select the Location that contains the tenant. This input collects Microsoft Defender for Endpoint machine inventory and assigns the ms:defender:machines source type.

Max Collection Pages (optional) sets a positive, finite page ceiling for one collection. The default is 10,000, including existing inputs with an empty or missing value. The input follows Microsoft’s complete continuation links and does not change the configured start date or introduce a new inventory snapshot/cursor model. If the collection needs more pages, the input fails without saving a final checkpoint. Raise the finite ceiling to accommodate the tenant; events already written can replay on the next run.

The final checkpoint is saved only after every page and event write completes. Checkpoint storage errors fail the run rather than report successful completion. If a write was accepted but its acknowledgement was lost, the stored checkpoint might already have advanced. This is not an exactly-once delivery guarantee.

Microsoft Defender Simulations

Select the Microsoft Graph Environment that contains the tenant. This input requires AttackSimulation.Read.All.

Max Collection Pages (optional) has the same positive, finite ceiling and failure/replay behavior as Machines, with a default of 10,000. It does not change configured history or introduce new time windows. The final checkpoint requires storage acknowledgement after the whole collection; optional report failures do not prevent collection of the base simulation event.

Microsoft Defender Event Hub

Configure the following settings:

Setting	Description
Event Hub Namespace(FQDN)	The fully qualified domain name of the Event Hubs namespace.
Event Hub Name	The event hub that receives Microsoft Defender XDR streaming events.
Consumer Group	The consumer group used by this input. Use a dedicated consumer group when another application also reads the event hub.
Streaming Event Types	An optional list of Advanced Hunting event categories to collect. If empty, the input collects every supported category.
Index	The destination Splunk index.

The input keeps an active Event Hubs connection, so Splunk Web displays its interval as 0. Retention depends on the Azure Event Hubs tier and namespace configuration.

The consumer uses a prefetch of 300 events and callback batches of at most 300 events, with a 10-second batch wait. Azure SDK retry attempts and backoff are finite; these are per-operation controls, not a lifetime cutoff for this continuous input. A partition checkpoint is updated after all selected records in the callback batch are written. A propagated write/checkpoint failure can cause replay from the last stored checkpoint; this is not exactly-once delivery. Event-size limits depend on the Azure tier, so the add-on does not impose a universal 1 MiB payload cutoff.

After you create an Event Hub input, you cannot edit Event Hub Name or Consumer Group. You can edit Azure App Account, Event Hub Namespace(FQDN), Streaming Event Types, and Index.

The Event Hub checkpoint is associated with the input name. If you change Azure App Account or Event Hub Namespace(FQDN), create a new input with a new name to prevent the input from reusing checkpoints created for a different Event Hubs resource.

If partitions are added after collection begins, the input resets its partition checkpoints. Existing partitions can produce duplicate events after the input restarts.

Note

An IPv6-only collection host requires DNS64 and NAT64 when the Event Hubs FQDN does not provide an IPv6 address.

Microsoft Defender Threat Intelligence Datasets

Configure the following settings:

Setting	Description
Datasets	One or more Microsoft Defender Threat Intelligence datasets to collect.
Identifiers File	A CSV or text file that contains one identifier per line for identifier-based datasets.
Interval	The collection interval in seconds.
Index	The destination Splunk index.

The Microsoft Threat Intelligence APIs require a Microsoft Defender XDR or Microsoft Sentinel license. The Microsoft Entra application also requires the ThreatIntelligence.Read.All application permission. Microsoft does not require a separate API license. See Use the Microsoft Graph APIs for Microsoft Threat Intelligence.

Microsoft API response budgets

Microsoft HTTP data/report responses and MDTI SDK responses are limited to 64 MiB of decoded bytes per response, including compressed, error and redirect bodies. A response over this ceiling is rejected before JSON parsing; Content-Length is not trusted. A server-requested retry wait above 3,600 seconds is rejected rather than sleeping for that duration. Ordinary retries, configured timeouts, authentication, proxy and TLS behavior remain in place. MDTI also retains its configured page size, page limit and worker count. These controls are per-response/per-operation budgets, not a guarantee of a fixed total process memory footprint. An optional Simulations report can fail independently while the base event is collected.

Alerts and Incidents stage each time window in memory before publishing it. A window can hold up to 64 MiB of UTF-8 event payloads and 100,000 output events, including nested incident alerts. If a response, page or staging budget is exceeded, the unpublished window is discarded and retried as smaller chronological windows. The checkpoint advances only after a complete window has been written. If a one-second window still exceeds a budget, collection fails without publishing that window or advancing its checkpoint. Output or checkpoint failures retain the usual at-least-once delivery behavior: a later input run can replay events that were written before the failure.

Required Event Hubs ports

Allow outbound HTTPS on TCP port 443. Azure Event Hubs clients can also require TCP ports 5671 and 5672 for Advanced Message Queuing Protocol (AMQP) connections. Splunk Cloud Platform administrators can use the Admin Config Service to configure required outbound connectivity.

See What ports do I need to open on the firewall? in the Microsoft documentation.

Configure inputs with configuration files

Splunk Cloud Platform deployments must configure this add-on in Splunk Web. Splunk Enterprise administrators can configure it with files.

1. On the heavy forwarder or deployment server, create $SPLUNK_HOME/etc/apps/Splunk_TA_MS_Security/local if it does not exist.
2. Create splunk_ta_ms_security_account.conf in the local directory.
3. Use $SPLUNK_HOME/etc/apps/Splunk_TA_MS_Security/README/splunk_ta_ms_security_account.conf.spec to configure the account stanza.
4. If you configure encrypted credentials on a deployment server, enable the script://$SPLUNK_HOME/etc/apps/Splunk_TA_MS_Security/bin/ms_security_encrypt_creds.py input in inputs.conf.
5. Create the required modular input stanzas by using $SPLUNK_HOME/etc/apps/Splunk_TA_MS_Security/README/inputs.conf.spec.
6. Deploy the configuration to the heavy forwarder.
7. Restart the heavy forwarder if required by your deployment method.
8. Verify that the inputs are enabled and collecting data.

Security audit records

The add-on writes JSON security records to $SPLUNK_HOME/var/log/splunk/Splunk_TA_MS_Security_security_audit.log. These INFO records are independent of the configured operational log level. They cover account, proxy/logging and input changes through the add-on REST endpoints (including Splunk Web), incident updates through the legacy and Graph actions, and Azure alert dismissal.

Records identify the authenticated Splunk execution principal, operation, configuration stanza or Microsoft resource, configured/effective tenant where applicable, UTC timestamp and outcome. Alert records also retain the Splunk-supplied search owner and SID when available. A scheduled action’s execution principal is not necessarily the person who originally configured the search. Result fields cannot override the recorded principal. If session identity or configuration context cannot be resolved, the corresponding status is explicitly unavailable; investigate these records rather than treating the search owner as a verified actor.

For configuration changes, success means Splunk accepted the persistence request. For Microsoft mutations, it means the API returned success. A later local processing error does not reverse that outcome. failure identifies a rejected operation, not_attempted identifies an action that did not reach the API, and unknown identifies an unconfirmed outcome, for example after a lost connection. Check the resource before retrying an operation with an unknown outcome. Configuration records also expose processing_outcome separately.

Security records use an explicit metadata allowlist and JSON escaping. They do not include session keys, client secrets, bearer tokens, proxy passwords, full request/response bodies or exception messages. Metadata strings are limited to 1,024 characters.

Deployment administrators control log forwarding, index access and retention through the standard Splunk configuration model. Verify that the log is collected from every host that runs configuration handlers or alert actions, restrict access to authorized operators, and retain records according to your organization’s policy. Local rotated log files alone are not a long-term audit archive. When the deployment collects these files in _internal, use:

index=_internal source=*Splunk_TA_MS_Security_security_audit.log* "security_audit="
| rex "security_audit=(?<audit_json>.*)"
| spath input=audit_json
| table timestamp principal principal_status search_owner sid operation resource_type resource_id tenant_id subscription_id outcome processing_outcome

Use deployment/platform audit controls for direct configuration-file changes and native Splunk configuration endpoints that bypass the add-on handlers. The add-on does not replace those controls or enforce a separate execution-role policy.

Supported input endpoints

The following table lists the endpoints used by the inputs. Select the environment or location where the input provides that setting. The Threat Intelligence Datasets input uses a fixed public-cloud endpoint.

Input	Environment or location	Endpoint
Microsoft Defender for Endpoint Alerts	General	api.securitycenter.microsoft.com
Microsoft Defender for Endpoint Alerts	US	api-us.securitycenter.microsoft.com
Microsoft Defender for Endpoint Alerts	EU	api-eu.securitycenter.microsoft.com
Microsoft Defender for Endpoint Alerts	UK	api-uk.securitycenter.microsoft.com
Microsoft Defender for Endpoint Alerts	GCC	api-gcc.securitycenter.microsoft.us
Microsoft Defender for Endpoint Alerts	GCC High/DoD	api-gov.securitycenter.microsoft.us
Microsoft Defender for Endpoint Alerts	Commercial & GCC - Graph API	graph.microsoft.com
Microsoft Defender for Endpoint Alerts	GCC High - Graph API	graph.microsoft.us
Microsoft 365 Defender Incidents	Commercial	api.security.microsoft.com
Microsoft 365 Defender Incidents	GCC	api-gcc.security.microsoft.us
Microsoft 365 Defender Incidents	GCC High	api-gov.security.microsoft.us
Microsoft 365 Defender Incidents	Commercial & GCC - Graph API	graph.microsoft.com
Microsoft 365 Defender Incidents	GCC High - Graph API	graph.microsoft.us
Microsoft Defender Simulations	Commercial & GCC - Graph API	graph.microsoft.com
Microsoft Defender Simulations	GCC High - Graph API	graph.microsoft.us
Microsoft Defender Machines	General	api.security.microsoft.com
Microsoft Defender Machines	US	api.security.microsoft.com
Microsoft Defender Machines	EU	api.security.microsoft.com
Microsoft Defender Machines	UK	api.security.microsoft.com
Microsoft Defender Machines	GCC	api-gcc.security.microsoft.us
Microsoft Defender Machines	GCC High/DoD	api-gov.security.microsoft.us
Microsoft Defender Threat Intelligence Datasets	Public cloud (fixed endpoint; no environment selector)	graph.microsoft.com

Validate data collection

Run the following search after you configure an input:

index=<index>
(sourcetype IN (
    "ms:defender:atp:alerts",
    "ms365:defender:incident",
    "ms365:defender:incident:alerts",
    "m365:defender:incident:advanced_hunting",
    "ms:defender:simulations",
    "ms:defender:eventhub",
    "ms:defender:machines"
) OR sourcetype="ms:defender:ti:*")
| stats count by sourcetype

Replace <index> with the input’s destination index. Verify that the expected source type appears and that its event count increases after the next collection interval.

Configure alert actions

The Splunk Add-on for Microsoft Security provides alert actions that run Advanced Hunting queries, update Microsoft Defender incidents, or dismiss Azure subscription-level security alerts.

Available alert actions

Alert action	Purpose
Defender Advanced Hunting	Run an Advanced Hunting query through Microsoft Graph and index the returned events.
Defender Update Incident	Update an incident through the Microsoft 365 Defender API and index the updated incident data.
Defender Update Incident via Graph API	Update an incident through Microsoft Graph and index the updated incident data.
Dismiss Azure Alert	Dismiss an Azure subscription-level security alert through the Azure Resource Manager API.

Before you configure an alert action

Complete the following prerequisites:

• Configure a Microsoft Entra application and an add-on account.
• Grant the permission required by the selected action. See Configure Microsoft Entra permissions.
• For Defender Advanced Hunting, grant the ThreatHunting.Read.All Microsoft Graph application permission and administrator consent.
• For Dismiss Azure Alert, assign the Microsoft Entra application an Azure role that includes Microsoft.Security/locations/alerts/dismiss/action for the target subscription. The built-in Security Admin role includes this permission.
• Configure the action on a search head, a Splunk Cloud Platform Victoria Experience deployment, or a heavy forwarder that can reach the selected Microsoft endpoint.

Note

Splunk Cloud Platform Classic Experience does not support the Defender Advanced Hunting alert action.

Configure an alert action

1. In Splunk Web, select Settings > Searches, reports, and alerts.
2. Create a new alert or open an existing alert.
3. In the alert settings, select Add Actions.
4. Select one of the alert actions listed in Available alert actions.
5. Select the add-on account. For Dismiss Azure Alert, explicitly select the account that has access to the target Azure subscription.
6. If the action displays Environment, select the environment that contains the Microsoft tenant.
7. If the action displays Tenant ID, optionally enter a tenant ID to override the tenant ID stored with the selected account.
8. Enter the remaining values required by the selected action.
9. Save the alert.
10. Trigger or run the alert and verify its result in Splunk Web.

Configure Defender Advanced Hunting

The Defender Advanced Hunting action uses the following Microsoft Graph hosts:

Environment	Microsoft Graph host
Commercial and GCC	graph.microsoft.com
GCC High	graph.microsoft.us
DoD	dod-graph.microsoft.us

Enter a valid Kusto Query Language (KQL) query in Query. The query is required. The action does not expose a Timespan field; Microsoft Graph applies its default query timespan when the request omits that property.

The add-on sends customer KQL unchanged, executes search-result queries sequentially, and validates each response against a 64 MiB decoded-byte ceiling and a 100,000-row ceiling. It does not silently truncate results or introduce an additional query-history cutoff. See Microsoft’s Hunting request contract for provider timespan behavior.

Overall action workload and execution duration also depend on the deployment’s standard Splunk alert/search settings, including maxresults and maxtime in alert_actions.conf. Administrators control these settings, scheduling and concurrency. The add-on does not impose a separate aggregate query-count cap or verify the effective deployment settings. A 60-second HTTP timeout is not an end-to-end wall-clock deadline; ordinary Requests redirect handling is retained. Verify finite platform limits appropriate for the deployment rather than treating unit tests as proof of the installed configuration.

Existing saved actions are mapped to Microsoft Graph environments when version 5.0.0 runs. Previous saved values do not reliably distinguish GCC High from DoD. After upgrading, open each DoD alert action and explicitly select DoD. See Upgrade to version 5.0.0.

Configure Dismiss Azure Alert

The Dismiss Azure Alert action uses the Azure Resource Manager API in the Azure public cloud. It does not support Azure Government or Azure operated by 21Vianet.

Configure the following fields:

Field	Description
Select Account	The add-on account whose Microsoft Entra application has permission to dismiss alerts in the target subscription. Select an account explicitly so the action does not fall back to the first configured account.
Subscription ID	The Azure subscription that contains the security alert. The default token is $result.subscription_id$.
Alert Location	The Azure location associated with the security alert, such as eastus or westeurope. The default token is $result.alert_location$.
Alert Name	The unique name or identifier of the Azure security alert. The default token is $result.alert_name$.

The search results that trigger the alert must contain values for Subscription ID, Alert Location, and Alert Name, either through the default result tokens or through values that you enter in the action configuration. The action changes the alert state to dismissed; it does not index a new event.

For the Azure permission definition, see Azure permissions for Security. For the built-in role that can dismiss alerts, see Security Admin.

Monitor the add-on with dashboards

The Splunk Add-on for Microsoft Security includes a Monitoring Dashboard for collection activity, errors, and resource usage. Its Internal tab contains the add-on-specific panels for Microsoft Defender Threat Intelligence ingestion, input errors, and collection performance.

Open the dashboard

1. In the add-on, select Monitoring Dashboard.
2. Select the Internal tab to use the panels described on this page.

The previous MS Security TA logs, MS Security TA Errors, and MDTI ingestion stats views are consolidated into sections on this tab.

The panels use operational data from _internal, _introspection, and _configtracker, as well as the index that stores Microsoft Defender Threat Intelligence events. You need access to the relevant indexes. Panels can be empty when the required logs, metrics, or events are unavailable for the selected period.

MS Security TA Performance & Monitoring

On the Internal tab, use the MS Security TA Performance & Monitoring section to review collection activity and resource usage.

1. Set Time for logs to the period that you want to investigate.
2. Review the panels for the affected input.

The collection panels summarize counts recorded in input logs. The version panel reports the version installed on the local Splunk instance and is independent of the time filter.

This section includes panels for the following information:

• the installed add-on version
• application roles when DEBUG logging is enabled
• CPU and memory usage when per-process introspection data is available
• endpoint alert collection counts
• incident and associated alert collection counts
• Event Hub received, skipped, and ingested event counts
• Advanced Hunting query result counts from the alert action
• simulation collection counts
• events per second by source type
• configuration-file changes and update frequency

MS Security TA Error Monitoring

On the Internal tab, use the MS Security TA Error Monitoring section to find collection and API errors.

1. Set Time for logs to the period that contains the problem.
2. Review the panel for the affected input.

This section includes error panels for endpoint alerts, incidents, Event Hub, Advanced Hunting, and simulations.

MDTI Ingestion Statistics

On the Internal tab, use the MDTI Ingestion Statistics section to monitor Microsoft Defender Threat Intelligence dataset inputs.

1. Set MTDI Time Range to the period that you want to review. This filter is separate from Time for logs.
2. In MTDI Index, select the index that stores the Microsoft Defender Threat Intelligence data.
3. Use MDTI Sourcetypes to select the datasets for the event-ingestion charts and event/host count tables. MTDI Index and MDTI Sourcetypes apply only to these four panels, which are independent of the input-name, PID, and log-level filters.
4. Select MDTI Input Name for the input statistics, API health, and input-log panels. The input-name selector uses logs from the last 24 hours.
5. Use MDTI Input PID to filter Input Ingestion Stats /1m, API Health Metrics /1m, and Input Log by process. The Input Logs table groups logs for the selected input names across processes. Use MDTI Log Level to filter the Input Log panel.
6. Review the panels for the affected input.

This section includes the following information:

• one-minute ingestion rate by source type
• total one-minute ingestion rate
• event counts and distinct Splunk host counts by source type
• one-minute input statistics
• one-minute API health metrics
• input logs

Ended: Configuration

Troubleshoot

Troubleshoot the Splunk Add-on for Microsoft Security

Start troubleshooting in Monitoring Dashboard > Internal. Review the MS Security TA Error Monitoring and MS Security TA Performance & Monitoring sections. Set Time for logs to the period that contains the problem. See Monitor the add-on with dashboards for panel details and Microsoft Defender Threat Intelligence filters.

For troubleshooting steps that apply to all supported add-ons, see Troubleshoot add-ons.

Find add-on logs

Search the _internal index for the input name or the add-on log source. For example:

index=_internal source="*Splunk_TA_MS_Security*" (log_level=ERROR OR log_level=WARN)

Increase the logging level only while you reproduce a problem. Return it to its previous setting after collecting the required diagnostics.

Resolve a 403 Forbidden response

A 403 response indicates that Microsoft rejected an authorized request because the application does not have a required role or permission. The log can include a message such as Missing application roles.

1. Identify the input or alert action that returned the error.
2. Record the missing permission shown in the error response.
3. Compare the selected environment and API with the permission reference.
4. Add the missing Application permission to the Microsoft Entra application.
5. Grant administrator consent.
6. Run the input or alert action again.

For the Defender Advanced Hunting alert action in version 5.0.0, grant ThreatHunting.Read.All. The legacy AdvancedHunting.Read.All permission is not sufficient.

Resolve certificate verification errors

Do not disable TLS certificate verification for Microsoft endpoints.

If a Microsoft API request fails with CERTIFICATE_VERIFY_FAILED, verify the following conditions:

• the host clock is correct
• the Microsoft endpoint presents a complete and valid certificate chain
• an intercepting proxy presents a certificate issued by a trusted organizational certificate authority
• the certificate authority chain is available to the Python runtime used by the add-on

Coordinate custom certificate-authority installation with your Splunk platform administrator. Back up any local trust configuration and reapply it after an add-on upgrade if the deployment process replaces it.

On affected Windows deployments, version 5.0.0 handles the ASN1: NOT_ENOUGH_DATA certificate-store error for unverified loopback connections to the local Splunk REST service. This compatibility handling does not apply to verified connections to Microsoft endpoints.

Resolve missing field extractions

Conflicting knowledge objects from the legacy Microsoft 365 Defender Add-on for Splunk can override extractions from this add-on.

1. Identify whether the legacy add-on is installed.
2. Disable its inputs.
3. Disable the legacy add-on.
4. Run a search against newly indexed events.
5. Verify that the expected fields are present.

If the problem continues, confirm that the Splunk Add-on for Microsoft Security is installed on the search head and that its permissions allow users to read the knowledge objects.

Understand duplicate incident-alert events

Duplicate events are expected in the ms365:defender:incident:alerts source type when Microsoft Defender XDR returns unchanged alerts with an updated incident. See Duplicate incident-alert events.

Understand duplicate threat intelligence events

The ms:defender:ti:* source types can contain repeated dataset objects. Use stable Microsoft object identifiers when you deduplicate events in searches.

Recover a missing data interval

Create a temporary input with a start date at the beginning of the missing interval. The input can also collect events that an existing input already indexed, so monitor it and disable it after its checkpoint passes the end of the interval.

1. Create a temporary input with Start Date set to the beginning of the missing interval in UTC.

2. Monitor its checkpoint in the input log. For example:

   index=_internal source="*Splunk_TA_MS_Security_Incidents_<input_name>.log" "Updating" "checkpoint"
   

3. When the checkpoint is later than the end of the missing interval, disable the temporary input.

4. Verify the collected event-time range. For example:

   index=<index> sourcetype=<source_type>
   | timechart count by createdTime
   

5. Deduplicate any events that overlap with the original input.

Input start dates and checkpoint timestamps use Coordinated Universal Time (UTC).

Resolve Event Hub proxy authentication errors

Version 5.0.0 applies the global proxy configuration to both Event Hub authentication and Event Hub data collection. If authentication still fails:

1. In Configuration > Proxy Configuration, verify the proxy host, port, username, and password.
2. Verify that the proxy allows HTTPS connections to Microsoft identity endpoints and connections to the configured Event Hubs namespace.
3. If the proxy host is an IPv6 literal, enter only the address. The add-on adds the required URL brackets.
4. Save the proxy configuration.
5. Revalidate or recreate the Event Hub input.

Review the add-on logs for the original Azure Identity or Event Hubs error if the problem continues.

Ended: Troubleshoot

Reference

Source types

The Splunk Add-on for Microsoft Security assigns the following source types and Common Information Model (CIM) data models:

Source type	Data	CIM data models
ms:defender:atp:alerts	Microsoft Defender for Endpoint alerts	Alerts
ms365:defender:incident	Microsoft Defender XDR incidents	Ticket Management
ms365:defender:incident:alerts	Alerts associated with Microsoft Defender XDR incidents	Alerts
m365:defender:incident:advanced_hunting	Results returned by the Defender Advanced Hunting alert action	Authentication, Email, Endpoint, Network Traffic
ms:defender:simulations	Microsoft Defender attack simulation reports	Alerts
ms:defender:eventhub	Microsoft Defender XDR streaming events collected from Azure Event Hubs	Alerts, Authentication, Certificates, Email, Endpoint, Inventory, Network Traffic, Web
ms:defender:machines	Microsoft Defender for Endpoint machine inventory	Inventory
ms:defender:ti:articles	Microsoft Defender Threat Intelligence articles	None
ms:defender:ti:article_indicators	Indicators associated with threat intelligence articles	None
ms:defender:ti:certificates	Host certificate intelligence	None
ms:defender:ti:components	Host component intelligence	None
ms:defender:ti:cookies	Host cookie intelligence	None
ms:defender:ti:hostpairs	Host-pair intelligence	None
ms:defender:ti:passivedns	Passive DNS intelligence	None
ms:defender:ti:subdomains	Host subdomain intelligence	None
ms:defender:ti:trackers	Host tracker intelligence	None
ms:defender:ti:whois	WHOIS intelligence	None

For details about the data models, datasets, and fields, see the Splunk Common Information Model documentation.

Duplicate incident-alert events

The ms365:defender:incident:alerts source type can contain multiple events for the same alert. This behavior occurs because Microsoft Defender XDR returns the alerts associated with an incident whenever that incident is retrieved again.

For example, when the status of an incident changes but its associated alerts do not change, the add-on indexes the updated incident in ms365:defender:incident and indexes the returned associated alerts again in ms365:defender:incident:alerts.

Use stable Microsoft identifiers and the event time when you deduplicate alert events in searches. Do not assume that repeated collection means the alert itself changed.

Duplicate threat intelligence events

The ms:defender:ti:* source types can contain duplicate events when the Microsoft Defender Threat Intelligence API returns the same dataset object in more than one collection cycle. Use the identifiers supplied by Microsoft when you deduplicate these events.

Third-party software attributions

The following FOSSA report provides third-party software attributions for the Splunk Add-on for Microsoft Security version 5.0.0, including license texts, copyright notices, and dependency information.

Release	Report generated	Report
5.0.0	November 2, 2026	Download the third-party software report (PDF)

The report records FOSSA revision b61802353b43c57c2c48d7afdc77a4297527b73b. Package-specific notices are also provided in the THIRDPARTY file at the root of the installed add-on.

For reports associated with earlier releases, see Release history.

Ended: Reference

Release notes

Release notes for the Splunk Add-on for Microsoft Security

About this release

Version 5.0.0 of the Splunk Add-on for Microsoft Security was released on November 5, 2026.

Version 5.0.0 changes the Defender Advanced Hunting alert action to use Microsoft Graph. Before you upgrade, review the required migration steps.

Compatibility

Version 5.0.0 is compatible with the following software, Common Information Model (CIM) versions, platforms, and vendor products:

Component	Supported versions or products
Splunk platform	9.4.x, 10.0.x, 10.2.x, 10.4.x, 10.6.x, 10.7.x
Splunk Common Information Model	8.5.x
Operating systems	Windows and Linux
Vendor products	Microsoft Defender XDR, Microsoft Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

Version 5.0.0 supports the current Splunk platform field alias behavior. It does not support field alias configurations created for older field alias behavior. See Field alias behavior change in the Splunk Enterprise Release Notes.

New features

Version 5.0.0 includes the following new features:

• Microsoft Graph support for Defender Advanced Hunting. The Defender Advanced Hunting alert action now sends queries to the Microsoft Graph POST /v1.0/security/runHuntingQuery endpoint. The action supports Commercial and Government Community Cloud (GCC), GCC High, and Department of Defense (DoD) Microsoft Graph deployments.
• Detection status for alert evidence. The detection_status field contains the available detectionStatus values from legacy Microsoft Defender for Endpoint alert evidence and Microsoft Graph incident-alert entities.
• Inventory network fields for Defender machines. The ms:defender:machines source type now maps to the Inventory Network dataset. The ip and mac fields follow the CIM single-value contract and support IPv4 and IPv6 source values.
• Additional file hashes. The multivalue file_hashes field contains available MD5, SHA1, and SHA256 values from Graph and Event Hub file, image-load, and email-attachment events. The existing file_hash field remains available.

Breaking changes

Version 5.0.0 includes the following breaking changes:

• Defender Advanced Hunting requires a Microsoft Graph permission. The alert action no longer uses the legacy Microsoft Defender XDR /api/advancedhunting/run endpoint. Add the Microsoft Graph application permission ThreatHunting.Read.All and grant administrator consent before you upgrade. The legacy AdvancedHunting.Read.All permission does not authorize this action.
• Review saved cloud environments. Existing alert actions are mapped to Microsoft Graph environments during runtime migration. Previous saved values do not reliably distinguish GCC High from DoD. After you upgrade, explicitly select DoD for every DoD alert action.
• CIM field values changed. Several source, destination, signature, network-action, inventory-network, and simulation mappings changed to improve alignment with the CIM data models. Review searches, dashboards, and alerts that use these fields. See CIM mapping changes in version 5.0.0.
• Graph filesystem sizes use CIM kilobytes. For Graph DeviceFileEvents, file_size now converts the Microsoft FileSize byte count to numeric kilobytes, including zero and fractional values. Use the unchanged FileSize for bytes. Event Hub file/image kilobytes and email attachment bytes retain their existing units.
• Graph network null addresses are omitted. For Graph DeviceNetworkEvents, missing, empty, JSON-null, and literal null addresses leave src, src_ip, dest, and dest_ip unset instead of identifying an endpoint with the string null.
• Inventory statuses no longer populate boolean enabled. Event Hub DeviceInfo onboarding and DeviceNetworkInfo adapter operational status no longer populate CIM enabled with strings such as Onboarded or Down. Use the unchanged raw status fields, or the existing sensor-health/adapter status mapping. Genuine source enabled values remain available. See the migration guidance.

Fixed issues

Version 5.0.0 of the Splunk Add-on for Microsoft Security fixes the following issues:

• Checkpoint-safe Microsoft Graph pagination. Graph incident and alert checkpoints advance only after the add-on successfully processes every page in a query window. If a later page fails, the next run retries the incomplete window instead of skipping unprocessed data.
• Windows Python 3.13 native imports. The add-on includes the matching Python 3.13 stable-ABI DLL required by its bundled Cryptography and Protobuf extensions. This fixes native import failures when the extensions cannot locate python3.dll in the Splunk installation. The separate known issue when Python 3.9 is forced remains.
• Runtime libraries after an in-place upgrade. The add-on continues to use the Requests and urllib3 libraries supplied by Splunk when an older add-on installation leaves its own copies behind.
• Configuration and collection hardening. The add-on validates configuration labels, safely renders stored values, records configuration changes and mutating alert actions in a security audit log, and bounds collection resources.
• Third-party security updates. Updated bundled Cryptography to 50.0.0 on Windows and Linux, PyJWT to 2.15.1, and certifi to 2026.10.23. Updated OpenTelemetry dependencies for Python 3.13 and applied tracestate validation protection to the Python 3.9 bundle.

Known issues

Version 5.0.0 of the Splunk Add-on for Microsoft Security contains the following known issues:

Event Hub input can fail when Python 3.9 is forced on Windows

On Windows Server 2022 with Splunk Enterprise 10.4.4, forcing Python 3.9 for the Microsoft Defender Event Hub input can cause its Python process to crash during input initialization. The input fails to register with Splunk, preventing Event Hub data collection. This issue can occur before the input connects to Azure and does not require a particular event payload.

The add-on declares python.required = 3.9, 3.13. On Splunk Enterprise 10.4, this normally selects Python 3.13 when available. The default Python 3.13 configuration passed input initialization, REST, and restart checks in the tested environment. The affected range of other Windows and Splunk versions has not been established.

Workaround: On Splunk Enterprise 10.4 with Python 3.13 available, remove any local override that restricts the [microsoft_defender_event_hub] stanza in inputs.conf to python.required = 3.9, so that the add-on’s default version list applies. Alternatively, set python.required = 3.13 for that stanza. Restart Splunk and verify that the Event Hub input is available before resuming collection.

Third-party software attributions

Version 5.0.0 incorporates third-party software attributed in the Splunk Add-on for Microsoft Security version 5.0.0 report.

Release history

Version 5.0.0 is the latest release of the Splunk Add-on for Microsoft Security. It was released on . See Release notes for information about the current release.

Version 4.0.0

Version 4.0.0 of the Splunk Add-on for Microsoft Security was released on .

Version 4.0.0 is compatible with the following software, Common Information Model (CIM) versions, platforms, and vendor products:

Component	Supported versions or products
Splunk platform	9.3.x, 9.4.x, 10.0.x, 10.2.x
Splunk Common Information Model	8.5.x
Operating systems	Windows and Linux
Vendor products	Microsoft Defender XDR, Microsoft Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

Version 4.0.0 supports the current Splunk platform field alias behavior. It does not support field alias configurations created for older field alias behavior. See Field alias behavior change in the Splunk Enterprise Release Notes.

New features

Version 4.0.0 includes the following new features:

• Observability metrics. The incidents, endpoint alerts, machines, simulations, and Event Hub modular inputs emit observability metrics for collection-health monitoring.
• Configurable query windows. The incidents and endpoint alerts inputs split Microsoft API requests into windows controlled by Max Query Window. The setting helps high-volume tenants avoid oversized requests.
• Retry handling. Microsoft Graph requests retry transient HTTP 500 and 503 responses.
• Checkpoint precision. Checkpoint timestamps normalize subsecond precision to prevent timestamp-rounding gaps or duplicate collection.
• Python 3.13 support. Modular inputs declare support for Python 3.9 and Python 3.13.

Breaking changes

Version 4.0.0 includes the following breaking changes:

• Python 3.7 is no longer supported. The minimum supported Python version is 3.9.
• Third-party and development dependencies changed, including the replacement of the legacy modular-input test framework.

Fixed issues

Version 4.0.0 of the Splunk Add-on for Microsoft Security fixes the following issues:

Known issues

Version 4.0.0 of the Splunk Add-on for Microsoft Security contains the following known issues:

Third-party software attributions

Version 4.0.0 incorporates third-party software attributed in the Splunk Add-on for Microsoft Security version 4.0.0 report.

Version 3.0.0

Version 3.0.0 of the Splunk Add-on for Microsoft Security was released on .

Version 3.0.0 is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

• Enhanced Advanced Hunting event mapping

  • Expanded the mapping coverage for Advanced Hunting events to provide broader CIM compatibility.
  • Added the event types listed in New event types and the field mapping changes listed in Field mapping changes.

• Optimized data ingestion efficiency

  • Replaced the previous recursive pagination (loading all results into memory) with iterative chunked collection, reducing memory usage, improving performance and stability under rate limits, and enabling earlier incremental checkpoint updates for faster recovery.

• Lookback option for incident and alert inputs

  • Added a configurable lookback parameter that lets administrators define custom query time ranges.

• Monitoring dashboard

  • Added a Monitoring dashboard for operational visibility. The previous metrics and original monitoring dashboard remain available on the Internal tab.

New event types

Source type	Category	Fields added
ms:defender:eventhub	AdvancedHunting-AlertInfo	app, id, severity, signature, type, vendor_product
ms:defender:eventhub	AdvancedHunting-AlertEvidence	description, id, severity, type, user, vendor_account
ms:defender:eventhub	AdvancedHunting-EmailAttachmentInfo	file_name, file_create_time, file_hash, action, file_access_time, file_acl, dest, file_path, file_size, vendor_product, process_id, vendor_account
ms:defender:eventhub	AdvancedHunting-EmailEvents	action, internal_message_id, message_id, recipient, recipient_count, recipient_domain, src_user, src_user_domain, subject, vendor_product
ms:defender:eventhub	AdvancedHunting-EmailUrlInfo	action, internal_message_id, url, vendor_product
ms:defender:eventhub	AdvancedHunting-IdentityLogonEvents	action, app, authentication_method, authentication_service, dest, dest_nt_domain, signature, src, src_user_id, vendor_account

Field mapping changes (Breaking changes)

Source type	Category	Fields modified	2.5.4 extractions	3.0.0 extractions	Comments
ms:defender:eventhub	AdvancedHunting-DeviceRegistryEvents	dest	tenantId	DeviceName	field mapping change
ms:defender:eventhub	AdvancedHunting-UrlClickEvents	vendor-product	DefaultTenant	Microsoft Defender for Endpoint	default value change
ms:defender:eventhub	AdvancedHunting-UrlClickEvents	action	ClickAllowed	allowed	value change according to Data Model specification when property ClickAllowed is ActionType
ms:defender:eventhub	AdvancedHunting-DeviceFileEvents	file_size	FileSize/1000	FileSize/1024	now calculated in bytes
ms:defender:eventhub	AdvancedHunting-DeviceFileEvents	dest	tenantId	DeviceName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceImageLoadEvents	action	read	allowed	value change according to Data Model specification when property ClickAllowed is ImageLoaded
ms:defender:eventhub	AdvancedHunting-DeviceImageLoadEvents	dest	tenantId	DeviceName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceImageLoadEvents	file_size	FileSize/1000	FileSize/1024	now calculated in bytes
ms:defender:eventhub	AdvancedHunting-DeviceLogonEvents	dest	RemoteIP	DeviceName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	dest	RemoteIP	DeviceName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	original_file_name	InitiatingProcessFileName	ProcessVersionInfoOriginalFileName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	parent_process_id	InitiatingProcessParentId	InitiatingProcessId	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	process	InitiatingProcessCommandLine	ProcessCommandLine	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	process_exec	InitiatingProcessFileName	derived from FolderPath	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	process_id	InitiatingProcessId	ProcessId	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	process_integrity_level	InitiatingProcessIntegrityLevel	ProcessIntegrityLevel	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	process_name	InitiatingProcessFileName	FileName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceNetworkEvents	process_path	InitiatingProcessFolderPath	FolderPath	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceProcessEvents	action	created	allowed	value change according to Data Model specification when property ClickAllowed is ProcessCreated
ms:defender:eventhub	AdvancedHunting-DeviceProcessEvents	dest	TenantId	DeviceName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceProcessEvents	original_file_name	FileName	ProcessVersionInfoOriginalFileName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceProcessEvents	parent_process_exec	N/A	InitiatingProcessFileName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	dest	tenantId	DeviceName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	original_file_name	InitiatingProcessFileName	ProcessVersionInfoOriginalFileName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	parent_process_id	InitiatingProcessParentId	InitiatingProcessId	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	process	InitiatingProcessCommandLine	ProcessCommandLine	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	process_exec	InitiatingProcessFileName	derived from FolderPath	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	process_id	InitiatingProcessId	ProcessId	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	process_integrity_level	InitiatingProcessIntegrityLevel	ProcessIntegrityLevel	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	process_name	InitiatingProcessFileName	FileName	field mapping change
ms:defender:eventhub	AdvancedHunting-DeviceEvents	process_path	InitiatingProcessFolderPath	FolderPath	field mapping change

Fixed issues

Version 3.0.0 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 3.0.0 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 3.0.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.6.1

Version 2.6.1 of the Splunk Add-on for Microsoft Security was released on .

Version 2.6.1 is compatible with the following software, CIM versions, and platforms:

Splunk platform versions	9.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

Fixed issues

Version 2.6.1 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.6.1 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.6.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.6.0

Version 2.6.0 of the Splunk Add-on for Microsoft Security was released on September 26, 2025.

Version 2.6.0 is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.1.x, 9.2.x, 9.3.x, 9.4.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

Fixed issues

Version 2.6.0 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.6.0 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.6.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.5.4

Version 2.5.4 of the Splunk Add-on for Microsoft Security was released on June 24, 2025.

In previous versions, the add-on retrieved incidents through the REST API using the default descending order. When incident volume was high, this led to more than 50 Defender API calls per minute, surpassing the allowed limit. Some incidents during peak periods were missed and, because of the add-on’s internal state and logic, cannot be retrieved retroactively.

In this version, the add-on now retrieves data in ascending order, consistent with most Splunk-supported add-ons. If the Defender API limit is reached, it pauses and then continues retrieving data when allowed.

Version 2.5.4 is compatible with the following software, CIM versions, and platforms:

Splunk platform versions	9.1.x, 9.2.x, 9.3.x, 9.4.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

Fixed issues

Version 2.5.4 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.5.4 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.5.4 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.5.2

Version 2.5.2 of the Splunk Add-on for Microsoft Security was released on June 5, 2025. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.1.x, 9.2.x, 9.3.x, 9.4.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

Fixed issues

Version 2.5.2 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.5.2 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.5.2 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.5.1

Version 2.5.1 of the Splunk Add-on for Microsoft Security was released on June 5, 2025. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.1.x, 9.2.x, 9.3.x, 9.4.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

Fixed issues

Version 2.5.1 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.5.1 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.5.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.5.0

Version 2.5.0 of the Splunk Add-on for Microsoft Security was released on April 29, 2025. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.1.x, 9.2.x, 9.3.x, 9.4.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

• Added an input that collects data from the Microsoft List Machines API.
• Added mutual TLS (mTLS) support.
• Added the ms_security_machines and ms_security_eventhub_url_click_event event types.

Known issues

Version 2.5.0 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.5.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.4.1

Version 2.4.1 of the Splunk Add-on for Microsoft Security was released on December 5, 2024. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.1.x, 9.2.x, 9.3.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

Fixed issues

Version 2.4.1 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.4.1 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.4.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.4.0

Version 2.4.0 of the Splunk Add-on for Microsoft Security was released on November 25, 2024. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.1.x, 9.2.x, 9.3.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs, Microsoft Defender Threat Intelligence

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

• Added a modular input that collects Microsoft Defender Threat Intelligence datasets from Microsoft Graph.

Fixed issues

Version 2.4.0 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.4.0 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.4.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.3.0

Version 2.3.0 of the Splunk Add-on for Microsoft Security was released on July 29, 2024. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.1.x, 9.2.x
CIM	5.3.2
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 2.3.0 of the Splunk Add-on for Microsoft Security has the following new features.

• Added IPv6 support.

Fixed issues

Version 2.3.0 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.3.0 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.3.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.2.0

Version 2.2.0 of the Splunk Add-on for Microsoft Security was released on April 24, 2024. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.0.x, 9.1.0.x
CIM	5.2.0
Platforms	Windows and Linux
Vendor products	Microsoft 365 Defender, Defender for Endpoint, Azure Event Hubs

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 2.2.0 of the Splunk Add-on for Microsoft Security has the following new features.

• Added a modular input that collects simulation data from the Microsoft 365 Defender portal.
• Added a modular input that collects Microsoft Defender Advanced Hunting events streamed from the Microsoft 365 Defender portal to Azure Event Hubs.

CIM data model changes

There are no CIM data model changes for existing field extractions. The following tables describe the mappings for the modular inputs introduced in version 2.2.0.

Field changes

Source type	Attack type	Fields added	Fields removed
ms:defender:simulations	social	type, user_name, severity, src, app, dest, user, signature, signature_id

Source type	Category	Fields added	Fields removed
ms:defender:eventhub	AdvancedHunting-DeviceEvents	parent_process_name, user, parent_process_id, parent_process_path, action, original_file_name, process_exec, process_integrity_level, dest, process_path, vendor_product, process_id, process_hash, process_name, process
ms:defender:eventhub	AdvancedHunting-DeviceFileCertificateInfo	ssl_validity_window, src, ssl_issuer_common_name, dest, ssl_serial, ssl_subject_common_name, ssl_subject_organization, ssl_hash, ssl_start_time, ssl_signature_algorithm, ssl_end_time
ms:defender:eventhub	AdvancedHunting-DeviceFileEvents	file_name, file_create_time, file_hash, action, file_access_time, file_acl, dest, file_path, file_size, vendor_product, process_id, user
ms:defender:eventhub	AdvancedHunting-DeviceImageLoadEvents	file_name, file_hash, action, file_access_time, file_acl, dest, file_size, file_path, vendor_product, process_id, user
ms:defender:eventhub	AdvancedHunting-DeviceInfo	family, version, os, dest, vendor_product
ms:defender:eventhub	AdvancedHunting-DeviceLogonEvents, AdvancedHunting-DeviceNetworkEvents	parent_process_name, user, parent_process_id, parent_process_path, action, original_file_name, process_exec, process_integrity_level, dest, process_path, vendor_product, process_id, process_hash, process_name, process
ms:defender:eventhub	AdvancedHunting-DeviceNetworkInfo	mac, src_ip, name, ip, dest, interface, vendor_product, dns, status
ms:defender:eventhub	AdvancedHunting-DeviceProcessEvents	parent_process_name, user, parent_process_id, parent_process_path, action, parent_process, original_file_name, process_exec, process_integrity_level, dest, process_path, vendor_product, process_id, process_name, process
ms:defender:eventhub	AdvancedHunting-DeviceRegistryEvents	action, registry_path, dest, registry_key_name, registry_hive, process_id, registry_value_type, vendor_product, registry_value_name, user

Note

This version adds field mappings for the new modular inputs. It does not remove any field mappings.

Fixed issues

Version 2.2.0 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.2.0 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.2.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.1.1

Version 2.1.1 of the Splunk Add-on for Microsoft Security was released on July 13, 2023. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.0.x
CIM	5.0.1
Platforms	Platform independent
Vendor products	Microsoft 365 Defender, Defender for Endpoint

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

CIM data model changes

There are no CIM data model changes between the Splunk add-on for Microsoft Security v2.1.0 and v2.1.1.

Fixed issues

Version 2.1.1 of the Splunk Add-on for Microsoft Security contains the following fixed issues.

Known issues

Version 2.1.1 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.1.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.1.0

Version 2.1.0 of the Splunk Add-on for Microsoft Security was released on June 13, 2023. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	9.0.x
CIM	5.0.1
Platforms	Platform independent
Vendor products	Microsoft 365 Defender, Defender for Endpoint

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 2.1.0 of the Splunk Add-on for Microsoft Security has the following new features.

• Added dashboards that provide operational information, errors, and recommended actions.
• Added support for configuring the add-on from a deployment server.
• Added a warning when an administrator creates an input with duplicate values.

CIM data model changes

There are no CIM data model or field extraction changes between versions 2.0.1 and 2.1.0 of the Splunk Add-on for Microsoft Security.

Fixed issues

Version 2.1.0 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.1.0 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.1.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 2.0.1

Version 2.0.1 of the Splunk Add-on for Microsoft Security was released on April 14, 2023. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	8.1.x, 8.2.x, 9.0.x
CIM	5.0.1
Platforms	Platform independent
Vendor products	Microsoft 365 Defender, Defender for Endpoint

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 2.0.1 of the Splunk Add-on for Microsoft Security has the following new features.

• Added Microsoft Graph API support for collecting incidents and alerts.
• Added Microsoft Graph API support for updating incidents and running Advanced Hunting queries.
• Updated the input and configuration pages.
• Added a default tenant ID value to the account configuration.
• Added CIM mappings for data collected through Microsoft Graph.

CIM data model changes

There are no changes to existing CIM data model mappings between versions 1.3.1 and 2.0.1. Version 2.0.1 adds the following mappings.

Field changes

Source type	Category	Fields added	Fields removed
ms:defender:atp:alerts	LateralMovement, Discovery, PrivilegeEscalation, SuspiciousActivity, DefenseEvasion, Collection, CredentialAccess, Execution, CommandAndControl, InitialAccess		signature_id
ms:defender:atp:alerts	None, Persistence		signature_id, user

Source type	threatFamilyName	Fields added	Fields removed
ms365:defender:incident:alerts	null		signature_id

Note

The add-on no longer extracts values such as null for the signature_id and user fields. There are no field changes for the m365:defender:incident:advanced_hunting source type.

Fixed issues

Version 2.0.1 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 2.0.1 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 2.0.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 1.3.1

Version 1.3.1 of the Splunk Add-on for Microsoft Security was released on October 13, 2022. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	8.1, 8.2, 9.0
CIM	5.0.1
Platforms	Platform independent
Vendor products	Microsoft 365 Defender, Defender for Endpoint

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 1.3.1 of the Splunk Add-on for Microsoft Security has the following new features.

• Changed the event type name prefix from ms_defender to ms_security.

Previous event type name	New event type name
ms_defender_incident	ms_security_incident
ms_defender_atp_alert	ms_security_atp_alert
ms_defender_advanced_hunting_sourcetypes	ms_security_advanced_hunting
ms_defender_advanced_hunting_process.	ms_security_advanced_hunting_process
ms_defender_advanced_hunting_filesystem	ms_security_advanced_hunting_filesystem
ms_defender_advanced_hunting_registry	ms_security_advanced_hunting_registry
ms_defender_advanced_hunting_delivery	ms_security_advanced_hunting_delivery
ms_defender_advanced_hunting_email	ms_security_advanced_hunting_email
ms_defender_advanced_hunting_authentication	ms_security_advanced_hunting_authentication
ms_defender_incident_alerts	ms_security_incident_alerts

• Added the host field to events ingested through alert actions.
• Updated the system path to prioritize the add-on’s third-party libraries during data collection.
• Improved input validation.
• Added the Tenant ID field to the alert action configuration.
• Added an account selector to the alert action configuration.
• Updated _time extraction for the ms:defender:atp:alerts and ms365:defender:incident:alerts source types. The add-on now uses the event’s last update time.

Fixed issues

Version 1.3.1 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 1.3.1 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 1.3.1 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 1.2.0

Version 1.2.0 of the Splunk Add-on for Microsoft Security was released on March 23, 2022. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	8.1, 8.2
CIM	5.0.0
Platforms	Platform independent
Vendor products	Microsoft 365 Defender, Defender for Endpoint

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 1.2.0 of the Splunk Add-on for Microsoft Security has the following new features.

• Added support for GCC and GCC High environments. Administrators with credentials for these environments can collect their data.
• Updated the defender_update_incident alert action.
• Added support for CIM version 5.0.0.

Fixed issues

Version 1.2.0 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 1.2.0 of the Splunk Add-on for Microsoft Security contains the following known issues.

Third-party software attributions

Version 1.2.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Version 1.1.0

Version 1.1.0 of the Splunk Add-on for MS Security was released on January 24, 2021. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	8.1, 8.2
CIM	4.20.2
Platforms	Platform independent
Vendor products	Microsoft 365 Defender, Defender for Endpoint

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 1.1.0 of the Splunk Add-on for Microsoft Security has the following new features.

• Introduced the Splunk Add-on for Microsoft Security as the successor to the Microsoft 365 Defender Add-on for Splunk.
• Renamed the m365:defender:incident source type to ms365:defender:incident and mapped it to the Ticket Management Incident data model instead of the Alerts data model.
• Enhanced CIM field mappings for the ms:defender:atp:alerts and m365:defender:incident:advanced:hunting source types.
• Added the ms365:defender:incident:alerts source type. During index-time processing, the add-on separates alert data from incident data. It indexes alert data as ms365:defender:incident:alerts and incident data as ms365:defender:incident.
• Removed the alert_queue, incident_queue, overview_alert, overview_detections, advanced_hunting, incident_detail, incident_overview, incident_update, and microsoft_defender_atp_alerts dashboard panels.
• Added support for CIM version 4.20.2.

Fixed issues

Version 1.1.0 of the Splunk Add-on for Microsoft Security fixes the following issues.

Known issues

Version 1.1.0 of the Splunk Add-on for MS Security contains the following known issues.

Third-party software attributions

Version 1.1.0 incorporates third-party software attributions for the Splunk Add-on for Microsoft Security.

Ended: Release notes