This Addon-on uses the Endpoint ...blob.core.windows.net for getting access to the Blob-Storage. The Microsoft German Cloud uses the Endpoint ...blob.core.cloudapi.de.
Is it possible to change the Endpoint the Add-on uses to access the Microsoft German Cloud?
The file you edit depends on which parts of the MSCS Add-on you’re using, and the steps here assume you have set up your Azure-side with the correct region etc.:
If you are using the MSO365 part of the MSCS Add-on:
splunk_ta_ms_o365_server_ucc_system_setting.conf
splunk_ta_ms_o365_api_settings.conf
Update the URLs to match the Azure Germany endpoints in those two files. Make sure that you update the API URL in both files before you restart to apply changes.
For the rest of the MSCS add-on functionality, these two files should be edited:
mscs_azure_accounts.conf.spec
<- Azure Account Setting Schema (For ingesting Azure Audit Events)mscs_storage_accounts.conf.spec
<- Azure Storage Account Setting SchemaFind the variable account_class_type
and set it to 3
(which should tell it to connect to the German endpoints).
Restart Splunk after changing these settings to apply the changes.
Note, if you’re using the MSCS Add-on for MSO365 data, you should migrate to the standalone MSO365 Add-on that was just recently released. It can live side-by-side with the current MSCS Add-on, but you have to disable the Office 365 modular input in the Splunk Add-on for Microsoft Cloud Service, see: http://docs.splunk.com/Documentation/AddOns/released/MSO365/Releasenotes
When setting account_class_type
to 3
the plugin tries to get data from chinacloudapi.net.
Setting it to 4
tells the plugin to use the German cloud.