- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Splunk Add on for MS Cloud Services: Audit.General...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Add on for MS Cloud Services: Audit.General and DLP.All (Security & Compliance) Events not showing
Hello,
We have the Splunk Add-on for Microsoft Cloud Services installed on a HWF and we are pulling through the following events.
Service Status,
Operational Message,
Exchange Online Audit,
Sharepoint Online Audit
Azure AD Audit
We don't seem to be getting any DLP (security & compliance) events or anything from audit.general either. Does anyone know what the issue might be?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Double check to see if you O365 tenant has DLP policies enabled for at least testing/monitor only, and the DLP policy items show up under:
sourcetype - ms:o365:management
user=DlpAgent
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Audit.general is not supported yet. We've submitted an enhancement request for it, and I've been told that they hope to have it available around .conf... so... hopefully soon.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
v2.1.0 in https://splunkbase.splunk.com/app/3110/ supports it supposedly. I updated the app...and in the MSapp -> inputs> edit your O365 api input> click on the data blank space field and Audit/General shows up to choose > click on it. Save. Wait. I'm keeping my fingers crossed...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Were you able to solve this problem? We submitted a product enhancement request that isn't supposed to be done until mid October and are looking for a quick solution to get it working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We haven't been able to resolve the problem yet, it looks like it's not supported on the add-on. We're looking to try and implement using the separate REST API Modular add-on https://splunkbase.splunk.com/app/1546/#/details
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
