Forum Discussion

SocInABox's avatar
SocInABox
Iron Contributor
Jul 13, 2023
Solved

azure activity connector not working

Hi there,   The Azure Activity Connector from the Sentinel Content Hub is not working for me.   I launched the Azure Policy Assignment wizard and created the Azure Policy as instructed.   For t...
microsoft sentinel
  • SocInABox's avatar
    SocInABox
    Jul 13, 2023
    Well heck, it's working now, I need to learn patience.

    I just recreated the policy, created/deleted resource group named 'TEST123' and after waiting about 5 minutes the log showed up.

    eliekarkafy, not not an incident, just a log in the AzureActivity table eg:
    AzureActivity|where ResourceGroup == "TEST123"

    All good now.
elieelkarkafi's avatar
elieelkarkafi
MVP
Jul 13, 2023

SocInABox you mean your not getting any incident in the sentinel portal when your creating or deleting a resource group in azure ?

RobbyD796's avatar
RobbyD796
Copper Contributor
Jan 20, 2024

elieelkarkafi I have not been able to get it working. I have waited 10+ hrs and when I go to Data Connectors it still says not connected!!

If anyone could help please?

  • G_Wilson3468's avatar
    G_Wilson3468
    Iron Contributor
    Feb 05, 2024

    RobbyD796 

    There could be a number of reasons Azure Active data connector is disconnected. Has it ever been connected, or did it disconnect after working? If you haven't ever had it connected, I would check a few things:
    1. Make sure you disconnect from legacy methods.
    2. Make sure that your policy scope is at the resource group level. It will not send data at the subscription level.

    Also make sure that you have checked the remediation task and set the remediation task. 


    Finally, be sure to look in the Log Analytics workspace to determine if you have logs coming in. 

Resources