splunk / splunk-add-on-microsoft-azure

Splunk Add-on for Microsoft Azure
Apache License 2.0
11 stars 7 forks source link

Offering $expand when $expand doesn't support 10+ results #82

Open runesecurity opened 1 month ago

runesecurity commented 1 month ago

Apologies if this has been asked/answered/reported.

I have a goal of daily reporting on users in groups for my Entra ID environment. Adding context to identities based on group membership is something I've wanted to do, and since we're an Entra ID (cloud) only directory, my hope was the groups endpoint of this TA would help.

Using $expand on members can only return 10 results, which I understand is simply a limitation of graph API, not really this TA. However, It doesn't appear I can add logic to my input to do paginated style requests of all the users in my groups using the group input.

At the very least I would hope this could be highlighted in bold under the tool tip for "filter". Like "You can use expand, but it only returns 10" or provide a way to loop through all the users.

Any insight is appreciated!