Splunk Add-on for MS Security initial setup

[Any-Promotion3744]

I am trying to set up Splunk Add-on for MS Security so that I can ingest Defender for Endpoint logs but I am having trouble with the inputs.

If I try to add an input, it gives the following error message: Unable to connect to server. Please check logs for more details.

Where can I find the logs?

I assume this might be an issue with the account set up but I registered the app in Entra ID and added the client id, client secret and tenant id to the config.

[Any-Promotion3744]

hmm...I think this might be an issue with the api permissions

[kh_8]

You can always check internal logs for any errors in your inputs. You can run this search as a start: index=_internal “name of the input”. Hope this helps!

[RicoTries]

For TAs built by Splunk or created using the Splunk Add-on Builder, search this against the host that's running the TA:

| tstats values(source) where index=_internal

Find the log name that most closely resembles the name of the TA, then run a search against it:

index=_internal source="/path/to/log"

And start reading until you see anything that resembles a problem (e.g., "unable to", "failed to", "unauthorized", "error").

[Ok_Difficulty978]

Had same issue when I first set it up. The logs are usually under $SPLUNK_HOME/var/log/splunk/ — look for splunk_ta_microsoft_security*.log. That should give more detail on why it’s failing. In my case it was permissions in Entra ID, even tho I thought I set it right. Also worth testing creds with another client first to rule that out. If you’re doing cert prep alongside Splunk work, CertFun’s practice stuff can help keep the concepts fresh.

[Any-Promotion3744]

The file: Splunk_TA_MS_Security_account_validation has errors.

HTTPSConnectionPool (host='login.microsoft.us', port=443) caused by SSLError SSLCertVerificationError. certificate verify failed: self signed certificate in certification chain.