splunk-microsoft-security-ta-setup

What problem does it solve?

This Skill enables onboarding, rendering, configuration, and validation of the Splunk Add-on for Microsoft Security data (Splunk_TA_MS_Security) within Splunk environments, reducing manual integration effort and ensuring consistent configuration.

Core Features & Use Cases

• Automated onboarding and configuration of Defender inputs, including incidents, alerts, machines, simulations, Event Hub streaming, and threat intelligence datasets.
• Render-first workflow that produces inputs, macros, runbooks, and validation SPL, along with readiness documentation for Splunk Cloud and on-prem deployments.
• Use Case: You need to onboard Defender data into Splunk and validate the ingest path in a repeatable, auditable manner.

Quick Start

Render the Microsoft Security TA assets for your Splunk environment and begin the installation and validation workflow.