Microsoft public ip downloader

Overview

Details

This could be used in coordination with Threat hunting.

You can download and index events from
https://www.microsoft.com/en-in/download/details.aspx?id=*

Supports CSV , XML and JSON

Capabilities :
Can download a flat file csv/json/xml from https://www.microsoft.com/en-us/download/details.aspx?id=*
Breaks it into per event and index in json format.

Usage :
This can be used by SOC to identify an IP address if the origin is from one of the Microsoft published public IP.

Inputs can be added/modified from the inputs page from UI or through inputs.conf

Example inputs:
[microsoft_public_ip://ServiceTags_US_government]
download_url_id = 57063
file_format = json
index = microsoft
interval = 86400
url_region = in

Release Notes

Version 1.0.7

Jan. 2, 2024

Added health checks of feed, including a dashboard.

Version 1.0.6

May 21, 2023

*Added XML parsing support

*Added alerts to identify exceptions [Exception on finding deep_link | 404] [Proxy error with Microsoft inputs]

*Added inputs template for easier use of data feeds

*Minor changes to pass Upgrade Readiness App test for V9

386

Downloads

Share Subscribe

Version

Built by

Vignesh Narendran

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

App Contents: Inputs

Compatibility

This version of the app (1.0.6) is not available for Splunk Cloud. However, version 1.0.7 of this app is available for Splunk Cloud.

Products: Splunk Enterprise, Splunk Cloud

Products: Splunk Enterprise

Splunk Versions: 9.3, 9.2, 9.1, 9.0

Platform: Platform Independent

Splunk Versions: 9.3, 9.2, 9.1, 9.0, 8.2

Platform: Platform Independent

Licensing

Splunk End User License for Third Party Content

Category & Contents

Categories: Firewall, Threat Intel

App Type: Add-on

Source Code: TA-microsoft-public-ip-generic

Subscribe Share

My Account

Support & Services