Merge pull request #261803 from batamig/splunk2

D4IOT splunk2

Author: Court72

articles/defender-for-iot/organizations/tutorial-splunk.md

@@ -2,7 +2,7 @@
 title: Integrate Splunk with Microsoft Defender for IoT
 description: This article describes how to integrate Splunk with Microsoft Defender for IoT for multidimensional visibility across OT protocols and IIoT devices. 
 ms.topic: how-to
-ms.date: 09/06/2023
+ms.date: 12/21/2023
 ms.custom: how-to
 ---
 
@@ -12,6 +12,13 @@ This article describes how to integrate Splunk with Microsoft Defender for IoT,
 
 Viewing both Defender for IoT and Splunk information together provides SOC analysts with multidimensional visibility into the specialized OT protocols and IIoT devices deployed in industrial environments, along with ICS-aware behavioral analytics to rapidly detect suspicious or anomalous behavior.
 
+If you're integrating with Splunk, we recommend that you use Splunk's own [OT Security Add-on for Splunk](https://apps.splunk.com/app/5151). For more information, see:
+
+- [The Splunk documentation on installing add-ins](https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall)
+- [The Splunk documentation on the OT Security Add-on for Splunk](https://splunk.github.io/ot-security-solution/integrationguide/)
+
+The OT Security Add-on for Splunk is supported for both cloud and on-premises integrations.
+
 ## Cloud-based integrations
 
 > [!TIP]
@@ -20,34 +27,29 @@ Viewing both Defender for IoT and Splunk information together provides SOC analy
 > Other benefits include real-time monitoring, efficient resource use, increased scalability and robustness, improved protection against security threats, simplified maintenance and updates, and seamless integration with third-party solutions.
 >
 
-If you're integrating a cloud-connected OT sensor with Splunk, we recommend that you use Splunk's own [OT Security Add-on for Splunk](https://apps.splunk.com/app/5151). For more information, see:
-
-- [The Splunk documentation on installing add-ins](https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall)
-- [The Splunk documentation on the OT Security Add-on for Splunk](https://splunk.github.io/ot-security-solution/integrationguide/)
-
+To integrate a cloud-connected sensor with Splunk, we recommend that you use the [OT Security Add-on for Splunk](https://apps.splunk.com/app/5151).
 
 ## On-premises integrations
 
-If you're working with an air-gapped, locally managed OT sensor, you need an on-premises solution to view Defender for IoT and Splunk information in the same place.
-
-In such cases, we recommend that you configure your OT sensor to send syslog files directly to Splunk, or use Defender for IoT's built-in API.
+If you're working with an air-gapped, locally managed sensor, you might also want to configure your sensor to send syslog files directly to Splunk, or use Defender for IoT's built-in API.
 
 For more information, see:
 
 - [Forward on-premises OT alert information](how-to-forward-alert-information-to-partners.md)
 - [Defender for IoT API reference](references-work-with-defender-for-iot-apis.md)
 
-
-
 ## On-premises integration (legacy)
 
-This section describes how to integrate Defender for IoT and Splunk using the legacy, on-premises integration.
+This section describes how to integrate Defender for IoT and Splunk using the legacy, [CyberX ICS Threat Monitoring for Splunk](https://splunkbase.splunk.com/app/4313) application.
 
 > [!IMPORTANT]
-> The legacy Splunk integration is supported through October 2024 using sensor version 23.1.3, and won't be supported in upcoming major software versions. For customers using the legacy integration, we recommend moving to one of the following methods:
+> The legacy **CyberX ICS Threat Monitoring for Splunk** application is supported through October 2024 using sensor version 23.1.3, and won't be supported in upcoming major software versions.
+>
+> For customers using the legacy CyberX ICS Threat Monitoring for Splunk application, we recommend using one of the following methods instead:
 >
-> - If you're integrating your security solution with cloud-based systems, we recommend that you use the [OT Security Add-on for Splunk](#cloud-based-integrations).
-> - For on-premises integrations, we recommend that you either configure your OT sensor to [forward syslog events, or use Defender for IoT APIs](#on-premises-integrations).
+> - Use the [OT Security Add-on for Splunk](https://apps.splunk.com/app/5151)
+> - Configure your OT sensor to [forward syslog events](how-to-forward-alert-information-to-partners.md)
+> - Use [Defender for IoT APIs](references-work-with-defender-for-iot-apis.md)
 
 Microsoft Defender for IoT was formally known as [CyberX](https://blogs.microsoft.com/blog/2020/06/22/microsoft-acquires-cyberx-to-accelerate-and-secure-customers-iot-deployments/). References to CyberX refer to Defender for IoT.