Generating a SAS URL

Step-by-Step: Generating a SAS URL

Access Azure Blob Container

• Log in to the Azure Portal.
• Navigate to your storage account and follow this path:
  Storage Browser → Blob Containers

Generating a SAS URL: Access Azure Blob Container

Generate the SAS URL

• Locate your container in the list.
• Click the three dots (…) next to the container name.
• Select “Generate SAS” from the menu.

Generating a SAS URL: Generate the SAS URL:

Configure SAS Settings

• A panel will appear on the right.
• Here you can define:
  • Permissions (Recommended: Create, Write, and optionally List)
  • Token validation period (start and expiry date/time)

Generating a SAS URL: Configure SAS settings

Copy the SAS URL

• After setting the permissions and time frame, click “Generate SAS token and URL”.
• Copy the resulting SAS URL and paste it into the Evidence Repository configuration in Splunk XDR Forensics.

Generating a SAS URL: Copy the SAS URL

If You Don’t Have a Container

• You can create one by clicking on “+ Add Container” in the Blob Containers view.

Generating a SAS URL: If you dont have a Container

Caution

Important Note

Each time you change a setting in the container (such as permissions or token expiry), you must generate a new SAS URL.

This ensures the connection between Splunk XDR Forensics and Azure remains valid.

Example: If you update the token expiration time or adjust permissions, please regenerate and update the SAS URL in AIR accordingly.