Learn how Microsoft makes Teams call record data available and how to get that data into Splunk with an add-on.

Transcript

Auto-generated captions, lightly cleaned. Speakers are not separately labeled.

do you want to monitor Microsoft teams call Quality data with Splunk we’ll stick around and I’ll show you how to do that with the Microsoft teams add-on for [Music] Splunk so Microsoft teams makes a lot of call Quality data available but getting that data can be somewhat of a challenge because there’s a lot of pieces involved don’t worry because I’m going to show you everything you need to know to get through it so at a high level there are three main pieces involved there is a change notification subscription A specialized web hook and a rest client now the change notification subscription it listens for changes to Microsoft teams calls in the Microsoft environment and it sends a notification to a specialized web Hook when these changes happen for example when a call ends the web Hook is notified about that event and I say this is a specialized web hook because it has to respond in a certain way with certain return codes and it has to implement specific validation logic it also has to be publicly available and https secured without any private certificates and it has to be addressable with a URL and finally the rest client will periodically read the IDS received by the web hook and make a call to the Microsoft graph API to retrieve the full call record it then sends this data to Splunk indexer all right so let’s set up all the add-on pieces to implement all three things the first thing we need to do is install the add-on now there are multiple ways to do this but we’ll walk through the end product experience from your Splunk instance select manage next to apps choose browse more apps type Microsoft team add-on for Splunk in the search box and then click install next to the Microsoft teams add-on for Splunk and we’re done now we need to set up our specialized web hook to receive the change notifications from the add-on we’ll click on inputs create new input teams web hook we’ll give it a name and the interval is how often the input will check the Run status you’ll select an index because the input does write some diagnostic information to this index about the web hook and select an available Port the rest of this information is used if you want to use an internal certificate with something like a load balancer in front of the add-on but we don’t need it for this demo but that does bring me to an important point the web hook has to be reachable externally because the data is coming from Microsoft to your web hook now you can open an external access access to your add-on but most people put something like a load balancer or a tunnel reverse proxy or something like that in front of their forer so that you don’t have to open up an Inbal port to your Splunk instance okay now let’s test the web hook Now by using the curl command we should see a success true message from the command line and searching Splunk we should see a M365 colon web hook event with the data all right now that we have our web hook up and running we need to set up a change notification subscription to send notifications to the web hook now to do this we have to authenticate to the Microsoft graph API so we’re going to take a bit of a detour to talk about Microsoft API graph authentication so the graph API authentication is done with something called an app registration and an app registration it’s a lot like a user account but instead of a username and password the app registration has a client ID and a client secret and a tenant ID and the add-on will use this information to connect to the Microsoft graph API to create an app registration we go into the Azure portal and from there we navigate to Microsoft intra ID and then app registrations I’ll create a new registration and give it a name and we can leave everything else as default and click the register button from here we can see our application ID and our tenant ID but now we need to generate a secret to do that I’ll click on certificates and secrets and new client secret you give the secret a name and an expiration time and then click add this brings up the value of the secret now this is similar to a password and it’s the only time we’ll see it here in the portal so I’ll copy this now and save it to a document for later now while we’re here I’ll go ahead and assign the necessary permissions to the app registration so this app registration will handle our change notification subscription and I’ll also use this app registration to retrieve call records to assign the permissions I’ll go to API permissions add a permission and these are Microsoft graph permissions so I’ll choose Microsoft graph the first permission is a delegated permission named subscriptions. read. all so I’ll select that and click the add permissions button the other permission we need is an application Level permission named call records. read. all so I’ll add that in the same way at this point the permissions have been assigned but they have not yet been granted if you’re logged into the Azure portal as an admin you can click the grant admin consent button here to finish things up up all right now we’re going to use the blunk add-on to create a change notification subscription to do that we first have to enter our app registration details in the configuration section of the add-on by navigating to the configuration tab click on the add button type in a name for the account that makes sense to you and then provide the client ID in secret this is basically creating a credential object that can be used by the other inputs next navigate to inputs select create new input and teams subscription give the input a name the interval tells the add-on to periodically update the subscription and select an index select the account we just created enter the tenant ID that we got earlier select the appro environment enter the address of the web hook we created earlier and the endpoint dropped down here lets you choose which version of the Microsoft graph API to use the differences between the 1.0 and the beta endpoints are documented on Microsoft’s website just note that the beta endpoint is subject to change without notice now once we click the add button the add-on sets up the change notification subscription and we can verify this by by searching in the index for M365 colon subscription the last piece of the puzzle is to set up a rest client that can retrieve the call record ID from the web hook notification and then use that ID to retrieve the full call record to do that navigate to create new input teams call record this is similar information used in the teams subscription input the interval on this one though tells the on how often to check for new call records so we’ll enter the information here and click the add button okay that’s it to recap we have our change notification subscription monitoring for teams call changes and when those changes happen a notification is sent to the web Hook and the team’s call record input runs on the specified interval to retrieve full call record details based on the data sent to the web hook all right so we have everything set up so I’m going to start a teams call to test this from end to end I’m going to start the call on this workstation and join it from another browser okay so here is our team’s call record and there is a lot of data in here you have information about the organizer all the participants and most importantly the session which has things like Jitter and packet loss and frame rate rates and round trip time and all sorts of user experience data so to make this data more usable we’re going to install the Microsoft 365 app for Splunk is it has a lot of pre-built dashboards for this data and this is done just like installing the add-on and I’m going to use the in product experience again now that the app is installed navigate to teams call record monitoring teams call overview and this will show you an overview of all the calls that are happening in your environment and the teams call qos dashboard will give you information about audio and video quality along with individual metrics and you can even search for specific calls that have happened and drilled down into detailed information and there you have it we installed and configured the Microsoft teams addon for Splunk we set up the Splunk side and the Microsoft side and explored call record data now you can get started today by visiting Splunk base.com for this add-on and a whole lot more happy splunking