Microsoft released an updated Teams API, and it makes getting call record data into Splunk much easier. In the past, you had to set up three separate pieces including a publicly-accessible and specialized HTTPS web hook, a subscription, and a REST client. Now, it is just one Splunk input. But wait, there’s more - you can now get historical call record data too!

Transcript

Auto-generated captions, lightly cleaned. Speakers are not separately labeled.

Microsoft released a new Teams API and it makes getting call record data into Splunk much easier and we’re going to go set it all up right [Music] now. Hey everyone, Jason Conger here and today we’re talking Microsoft Teams and Splunk. So, Microsoft makes a lot of Teams data available, but it used to be a pain to get to because you needed to set up a specialized web hook and you had to set up a subscription to send notifications to that web hook and maintain that subscription and then you needed a REST client to go get call record details. There were a lot of moving parts to this, but now it’s just one Splunk input. So, let’s go set it up. Okay, we’re going to start out with a clean Splunk instance and we’re going to use the inproduct browser to install the Teams add-on. So, I’ll come over here for browse more apps and come over here and type teams add-on. Click install, authenticate, and we’ll open the app. So, the next thing we need to do is configure the add-on to connect to the Teams API. First thing we’ll do is click add here, and that’s going to add an account. And you see it’s prompting for this client ID and client secret. Well, those things come from an enter ID app registration. And you can think of an app registration like a user object, but instead of a username and a password and a domain, you’re going to have a client ID and a client secret and a tenant ID. And the app registration is used to authenticate to the team’s API. So, let’s go set that up. All right. So, here we are in the Azure portal. And the first thing we’ll go to is Microsoft Entra ID. And then we’ll go over here to app registrations and create a new registration. Give it a name and click register. So at this point you see we have the application ID also known as the client ID. Uh we have the directory ID also known as the tenant ID. And I’m going to make a note of those on a document right now. So we have our client ID and we have our tenant ID saved in a document. The next thing we need is the client secret. And we come over here to certificates and secrets. And you can think of this as creating a password for app registration. So I’ll click new client secret. And I’ll give it a name and an expiration time and click add. Now this is the only time that the value of the client secret is going to show up in the portal. So we’re going to make a copy of this now and put it in our document so we can have it for access later. Okay. So now we’ve created our credential object. The next thing we need to do is give this app registration rights to do what it needs to do. And to do that we’ll come over here to API permissions. And this is a graph API that we’re going to be using. So I’ll click add permission Microsoft graph. And this will be an application permission and it’s going to be call records readad.all. Click add permissions. And the next thing we need to do is grant consent for this permission so that it can actually do what it needs to do. All right, we’re done with the Azure portal at this point. Everything else is going to be on the Splunk side. So, let’s go take a look. All right, here’s where we left off with our account name, client ID, and client secret. So, I’m going to give this a name for Splunk to know, and then I’ll go grab the client ID and the client secret that I copied on my document earlier. Okay, so now all I’ve really done is saved a credential object that my input can then go use. So, the next step is we’re going to go set up the input. So, come over here to inputs. create new input and it’s going to be the team’s call record input. And I’ll just give this a name. An interval is how often to check for new call records. the index we want to put it in, the account that we just created, the tenant ID, which I copied onto my document earlier, there’s the environment, whether it’s public or government, and the checkbox if I don’t want to index any null values. And I can go back in time with this input. So, this is something new. You could not do this before with the web hook method. Now, we can go up to 30 days in the past. If I don’t specify a value here, it will go 7 days in the past. And then finally, the endpoint. There is a beta endpoint. Use it at your own risk, but the V1 endpoint is what we’ll use today. And click add. That’s it. At this point, the input should go out and get any call record data that we have already for the past seven days. And index it right here in Splunk. Okay, let’s go see what data we have. So, here’s our call record. I did a test call with three participants. I had an organizer and two guests. And looking at this data, the first thing we’ll look at is the modalities, which is what was used during the call. So, we used audio, video, and we did some sharing. You see the organizer, which was yours truly. And then you have your participants. Again, three participants. I had a guest and then I had myself on here and another guest. Now, the next piece that we’re going to point out is the sessions. So, typically there’s going to be a ratio of one session for every participant in the call and we’re going to go explore what’s actually in a session. So, you’re going to have your caller and your colleague. So, that’s going to be between the end user and the endpoint here. And then you’ll have the repeat of the modalities again audio, video, screen sharing. And then the next thing that interesting here is the segments. So these are basically the media connections used by this particular user in the session. And if we look a little bit here in the media, we will see there are several medias used. And this one is the data stream. And you’re going to get all of the metrics about the data stream. And you’re going to get both directions. So you’re going to get caller to colle. So caller to the endpoint and endpoint back to the caller. So you can get both directions of the data stream that you saw. And over here we’re going to look at here is the main video stream. Again, you’ll have both directions and all of the metrics that go with each direction. So, at this point, you have access to all the data and you can go start building your searches and your visualizations to give you some quality of service metrics around all of your team’s user experience. But, we’re not going to leave you there and make you do it all by yourself. So there is an app that we’re about to install that gives you a lot of visualizations for this data. So we’ll come back over here to the end product browser. We’ll go for browse for more apps and we’ll look at the Microsoft 365 app. We go ahead and click install here to install the app. And this is going to be a lot of dashboards and visualizations for the data that’s collected by the add-on. We’ll open the app and over here under teams we have call record monitoring and we can go get an overview of all the calls that are going on in our environment and then we can actually drill down to individual calls to get all of those metrics in a visual format here. So here we see the same information we just looked at like the modalities used during the call and the types of calls. this was a group call and even where in the world the calls are coming from. So if I wanted to get all of that call metric data, I can come over here to call record monitoring and do a call search if I’m looking for a specific one. But here’s the call that we had as our test. And drilling down into that will give me all of the metrics about the call itself. So, here is all of the quality of service data. Things like the jitter, the roundtrip time, all of the audio and video, all visualized for you right here out of the box with this app. So, I hope that helps and happy splunking.