About njytrde

njytrde · ‎10-27-2021

Hello, On the HF of this add-on there is an Inputs configuration. On the Content Type drop down, there is a choice of four different types for audit. Screen shot attached. Does anyone have the link to documentation for what the differences are for logging the those audit.selections?

njytrde · ‎05-04-2020

So it turns out, the problem was, when I updated the TA version to 2.1 for Microsoft Azure Add-on for Splunk, the API permissions changed. Once Directory.Read.All and AuditLog.Read.All was added for the application and delegation for the microsoft graph, the logs started ingesting normally again.

njytrde · ‎04-28-2020

Hello all, I recently upgraded the Microsoft Azure Add-on TA to version 2.1. Not only did it break the configuration, but there are also some added permissions that need to be applied on the Azure portal side. I worked with someone on our Windows AD team who has the necessary access but he did not see what is referenced below in the details of the Add-on. https://splunkbase.splunk.com/app/3757/ Microsoft Azure Active Directory Sign-ins Microsoft Graph Read all audit log data Windows Azure Active Directory "(Application) Read directory data (Delegated) Read directory data" Microsoft Azure Active Directory Users Microsoft Graph Read all audit log data Windows Azure Active Directory "(Application) Read directory data (Delegated) Read directory data" Microsoft Azure Active Directory Audit Microsoft Graph Read all audit log data Windows Azure Active Directory "(Application) Read directory data (Delegated) Read directory data" These are the errors in the internal logs. Any ideas? 04-28-2020 15:58:03.014 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" ERROR401 Client Error: Unauthorized for url: https://graph.microsoft.com/beta/auditLogs/directoryAudits? $orderby=activityDateTime&$filter=activityDateTime+gt+2020-04-21T15:58:02.316173Z+and+activityDateTime+le+2020-04-28T19:51:02.559995Z

njytrde · ‎02-18-2020

Hello Chris, While both version control apps look great, they are not compatible for Splunk cloud - which is where they would all need to be, on the ES search head. Have you found any alternatives to those needing it on the cloud?

njytrde · ‎07-15-2019

07-15-2019 11:23:04.955 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-Azure_Monitor/bin/azure_activity_log.sh" Modular input azure_activity_log://AzureSecurityEventHubUSEast2-NonProd Error getting event hub creds: SyntaxError: Unexpected end of JSON input I have regenerated the app id and key as by that error, as it sure looks like an authentication issue to me, still get the same error. Any idea on how to resolve this?

njytrde · ‎07-10-2019

Definitely the heavy forwarder, from my experience anyway.

njytrde · ‎06-25-2019

Hi jconger, I went to copy the splunklib as you directed, but all the files in the splunklib are already in the bin directory. Yes, I had my network team open ports 5671 and 5672 but I am only receiving the activity logs, not the diagnostic logs. -rw-rw-r-- 1 splunk splunk 57301 May 29 13:09 binding.py -rw------- 1 splunk splunk 55281 May 29 13:09 binding.pyc -rw-rw-r-- 1 splunk splunk 142847 May 29 13:09 client.py -rw------- 1 splunk splunk 148687 May 29 13:09 client.pyc -rw-rw-r-- 1 splunk splunk 8528 May 29 13:09 data.py -rw------- 1 splunk splunk 9235 May 29 13:09 data.pyc -rw-rw-r-- 1 splunk splunk 771 May 29 13:09 init.py -rw------- 1 splunk splunk 451 May 29 13:09 init.pyc drwxrwxr-x 2 splunk splunk 4096 May 29 13:09 modularinput -rw-rw-r-- 1 splunk splunk 4223 May 29 13:09 ordereddict.py -rw-rw-r-- 1 splunk splunk 4692 May 29 13:09 ordereddict.pyc -rw-rw-r-- 1 splunk splunk 10820 May 29 13:09 results.py -rw-rw-r-- 1 splunk splunk 9437 May 29 13:09 results.pyc drwxrwxr-x 2 splunk splunk 4096 May 29 13:09 searchcommands -rw-rw-r-- 1 splunk splunk 30098 May 29 13:09 six.py -rw------- 1 splunk splunk 31599 May 29 13:09 six.pyc [root@xxxxxxxxxx splunklib]# pwd /opt/splunk/etc/apps/TA-Azure_Monitor/bin/splunklib Any ideas?

njytrde · ‎06-15-2019

Hello, I am trying to ingest Azure Activity Logs and Azure Diagnostic logs into our Splunk cloud environment. Per another question on Azure Activity logs, I was able to find out that I needed to have port 5671 for the Activity logs. I had that done through my network team and am now getting the Activity logs, but NOT the Diagnostic logs. This is the error I get: 06-15-2019 02:19:57.727 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-Azure_Monitor/bin/azure_diagnostic_logs.sh" Modular input azure_diagnostic_logs://New Azure Monitor Diagnostic Log No connection on hub: docs05. Is there a network route to the endpoint? Also, this is through the Azure Monitor add-on, configured in Data Inputs. Please advise on what other port that I need open. Thanks!

njytrde · ‎06-03-2019

Hello, Has anyone successfully ingested logs from Microsoft Azure, specifically through the Event Hub Integrator add-on that is not supported by Splunk cloud? This is the add-on that I am referring to on splunkbase: https://splunkbase.splunk.com/app/4343/#/details I supplied information from the Azure portal and even edits on the props.conf stanza suggested on the Details part of the splunkbase. No logs coming at all, so no error messages to go on. I find it extremely difficult to believe that we are the only customer trying to ingest these logs from this app. Please help!

Posts	9
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎06-03-2019

Online Status	Offline
Date Last Visited	‎02-14-2022 08:08 PM

Splunk Add-on for Microsoft Office 365 - Inputs co...

Getting errors when upgrading to Microsoft Azure A...

Azure Monitor Add-on for Splunk: Activity log erro...

Error when ingesting Azure Monitor Diagnostic Log:...

Azure Event Hub Integrator logs to Splunk - no log...

Splunk Add-on for Microsoft Office 365 - Inputs co...

Re: Getting errors when upgrading to Microsoft Azu...

Getting errors when upgrading to Microsoft Azure A...

Re: Version control management for Splunk Dashboar...

Azure Monitor Add-on for Splunk: Activity log erro...

Re: Azure Monitor Addon - Where does it get instal...

Re: Azure Monitor Add-on For Splunk: Why are Input...

Error when ingesting Azure Monitor Diagnostic Log:...

Azure Event Hub Integrator logs to Splunk - no log...