Skip to content

Commit f08def5

Browse files
ljstellaljstella
authored
Merge pull request #3304 from splunk/auto-ta-update-162
Automated Splunk TA Update 162
2 parents 7712cd9 + cc90411 commit f08def5

22 files changed

+40
-25
lines changed

‎contentctl.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -155,9 +155,9 @@ apps:
155155
- uid: 3110
156156
title: Splunk Add-on for Microsoft Cloud Services
157157
appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
158-
version: 5.4.1
158+
version: 5.4.2
159159
description: description of app
160-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_541.tgz
160+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz
161161
- uid: 4055
162162
title: Splunk Add-on for Microsoft Office 365
163163
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365

‎data_sources/azure_active_directory.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2

‎data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ separator: operationName
1111
supported_TA:
1212
- name: Splunk Add-on for Microsoft Cloud Services
1313
url: https://splunkbase.splunk.com/app/3110
14-
version: 5.4.1
14+
version: 5.4.2
1515
fields:
1616
- _time
1717
- Level

‎data_sources/azure_active_directory_add_member_to_role.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_add_owner_to_application.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_add_service_principal.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_add_unverified_domain.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_consent_to_application.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_disable_strong_authentication.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_enable_account.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_invite_external_user.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_reset_password_(by_admin).yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_set_domain_authentication.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_sign_in_activity.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_update_application.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_update_authorization_policy.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_update_user.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: operationName
1010
supported_TA:
1111
- name: Splunk Add-on for Microsoft Cloud Services
1212
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
13+
version: 5.4.2
1414
fields:
1515
- _time
1616
- Level

‎data_sources/azure_active_directory_user_registered_security_info.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ separator: operationName
1111
supported_TA:
1212
- name: Splunk Add-on for Microsoft Cloud Services
1313
url: https://splunkbase.splunk.com/app/3110
14-
version: 5.4.1
14+
version: 5.4.2
1515
fields:
1616
- _time
1717
- Level

‎data_sources/azure_audit_create_or_update_an_azure_automation_account.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
1111
supported_TA:
1212
- name: Splunk Add-on for Microsoft Cloud Services
1313
url: https://splunkbase.splunk.com/app/3110
14-
version: 5.4.1
14+
version: 5.4.2
1515
fields:
1616
- _time
1717
- authorization.action

‎data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
1111
supported_TA:
1212
- name: Splunk Add-on for Microsoft Cloud Services
1313
url: https://splunkbase.splunk.com/app/3110
14-
version: 5.4.1
14+
version: 5.4.2
1515
fields:
1616
- _time
1717
- authorization.action

‎data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
1111
supported_TA:
1212
- name: Splunk Add-on for Microsoft Cloud Services
1313
url: https://splunkbase.splunk.com/app/3110
14-
version: 5.4.1
14+
version: 5.4.2
1515
fields:
1616
- _time
1717
- authorization.action

‎data_sources/azure_monitor_activity.yml

+18-3
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,17 @@ id: 1997a515-a61a-4f78-ada9-54af34c764f2
33
version: 1
44
date: '2025-01-13'
55
author: Bhavin Patel, Splunk
6-
description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
6+
description: Data source object for Azure Monitor Activity. The Splunk Add-on for
7+
Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure
8+
EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic
9+
settings > Add diagnostic settings & send events to the activity audit event hub.
710
source: Azure AD
811
sourcetype: azure:monitor:activity
912
separator: operationName
1013
supported_TA:
1114
- name: Splunk Add-on for Microsoft Cloud Services
1215
url: https://splunkbase.splunk.com/app/3110
13-
version: 5.4.1
16+
version: 5.4.2
1417
fields:
1518
- column
1619
- action
@@ -93,4 +96,16 @@ fields:
9396
- vendor_product
9497
- vendor_region
9598
- _time
96-
example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": ["<null>"], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}'
99+
example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388",
100+
"category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript",
101+
"properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1,
102+
"ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4",
103+
"ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false,
104+
"Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId":
105+
"00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"},
106+
"AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37",
107+
"Category": 3, "RelationId": null, "TargetDisplayNames": ["<null>"], "TargetObjectIds":
108+
["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name":
109+
"DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]},
110+
"resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00",
111+
"identity": "brian.cove@frothlydev.onmicrosoft.com"}'

0 commit comments

Comments
 (0)