SA-EntraID¶

    Supporting Add-on for Splunk Enterprise Security

Populate a KV Store with EntraID identities collected from the beta Graph API endpoint using the Splunk Add on for Microsoft Azure. This supporting add-on contains out of the box searches and KV Store lookups for integrating with the Assets and Identities ES Framework.

• Splunkbase
• Documentation

Author: Dean Luxton