Install the Splunk Add-on for Microsoft Security

Use the tables in this topic to determine where and how to install this add-on in a distributed deployment of Splunk Enterprise. See the installation walkthrough at the end of this topic for links to installation instructions specific to a single-instance deployment, distributed deployment, or Splunk Cloud.

Where to install this add-on for a distributed deployment

Unless otherwise noted, all supported add-ons can be safely installed to all tiers of a distributed Splunk platform deployment. This table provides a quick reference for installing this add-on to a distributed deployment of Splunk Enterprise.

Splunk instance type	Supported	Required	Comments
Search Heads	Yes	Yes	This add-on contains search-time knowledge. If possible, turn off visibility on your search heads to prevent data duplication errors that can result from running inputs on your search heads instead of, or in addition to, on your data collection node.
Indexers	Yes	No	Not required because the parsing operations occur on the forwarders.
Heavy Forwarders	Yes	No	Recommended. Install this add-on on a heavy forwarder for data collection. To avoid duplicates, configure data collection in a single location.
Universal Forwarders	No	No	Universal forwarders are not supported for data collection because the modular inputs require Python and the Splunk REST handler.

Installation walkthrough

See "Installing add-ons" in Splunk Add-Ons for detailed instructions describing how to install a Splunk add-on in the following deployment scenarios:

• Single-instance Splunk Enterprise
• Distributed Splunk Enterprise
• Splunk Cloud