search

splunk / splunk-add-on-microsoft-azure

Splunk Add-on for Microsoft Azure
Apache License 2.0
11 stars 7 forks source link

Missing normalised fields (userDisplayName) in CIM #70

Open ajoergensson opened 7 months ago

ajoergensson commented 7 months ago

This thread is meant to highlight the missing fields that should be normalised in the CIM

ajoergensson commented 5 months ago

Inside props.conf in the TA

FIELDALIAS-azure_aad_sign_in_authentication_user_display_name = userDisplayName AS user_display_name EVAL-user_display_name = lower(userDisplayName)