Unique AI Documentation

SEE - Setup with Splunk

2 min read

Table of contents

Overview

This guide connects the Unique Security Events Export to Splunk with the Splunk Add-on for Microsoft Cloud Services (MSCS) and its Azure Event Hub input.

see-splunk-pipeline.png

The MSCS Event Hub input authenticates with a Microsoft Entra application. It does not support connection strings. Unique creates this application for you and gives its identity the Azure Event Hubs Data Receiver role, scoped to your Event Hub namespace only.

Prerequisites

  • Splunk Cloud or Splunk Enterprise with the MSCS add-on installed on the data collection node.

  • Outbound connectivity from Splunk to the Event Hub endpoint.

  • The connection data from Unique: namespace hostname, Event Hub name, and consumer group.

  • The Entra application credentials from Unique: Tenant ID, Client ID, and a client secret. Unique delivers the secret through a one-time 1Password link. Treat it as secret.

Part A: Azure App account

Follow Connect to your Azure App account:

  1. Open the MSCS add-on and select Configuration → Azure App Account → Add Azure App Account.

  2. Set a Name without whitespace.

  3. Set the Authentication Type to client_secret.

  4. Enter the Client ID, the Key (Client Secret), and the Tenant ID from Unique.

  5. Save the account.

Part B: Event Hub input

Follow Configure an Azure Event Hub input:

  1. Select Inputs → Create New Input → Azure Event Hub.

  2. Set a Name without whitespace.

  3. Select the Azure App Account from Part A.

  4. Set the Event Hub Namespace to the hostname from Unique. The value ends with .servicebus.windows.net.

  5. Set the Event Hub Name to the value from Unique.

  6. Set the Consumer Group to the value from Unique. Do not use $Default.

  7. Keep the defaults for Max Batch Size (300), Max Wait Time (300), and Interval (3600), or adjust them to your ingestion policy.

  8. Select an Index and set the Sourcetype to mscs:azure:eventhub.

  9. Enable the input.

Part C: Validation

  1. Search the index and make sure events arrive with sourcetype mscs:azure:eventhub.

  2. Defender alerts and Activity Log records arrive in the same stream. Route and filter the records in Splunk.

  3. Do the connection test with Unique: Unique generates sample alerts in Microsoft Defender for Cloud. Confirm that the alerts appear in your index.

If you use Data Manager for Splunk Cloud instead of the MSCS inputs, give your architecture documentation to Unique up front. Unique does not maintain expertise on Data Manager.

Last updated