Forum Discussion
MicrosoftEverything Azure Sentinel connectors
Hi Everyone,
I have finalized my blog series on ingesting data to Azure Sentinel and thought you might find a summary useful.
Even if you don't find the event, or enrichment, source in one of the built-in connectors, good chances that Sentinel does support it, and if not, Sentinel has a broad array of tools to create custom connectors.
Here are the relevant blog posts to guide you to find your connector or develop a custom one:
- Using the agent to collect telemetry from on-prem and IaaS server
- Collecting Azure PaaS services logs
- The Syslog and CEF source configuration grand list
- Creating Custom Connectors
~ Ofer
3 Replies
Dear Ofer_Shezaf,
how to monitor the status of Sentinel connectors (using KQL)? in the context of my problem, there are two types of connectors (1) the ones with frequent data ingestion (e.g. Azure Activity, Azure Active Directory, Syslog) and (2) the ones with eventual data ingestion (e.g. Microsoft Cloud App Security, Azure Advanced Threat Protection, Azure Security Center, Microsoft Defender Advanced Threat Protection​). For the first type, it is easy to monitor via anomaly behaviour functions. My struggle is with the second type. Do you have any idea on how can I address this?Thanks in advance.
- Ofer_Shezaf
jjsantanna : there is no easy way to detect anomalies or issues in a phenomenon that has not predictability. Nothing specific to Azure Sentinel here. I think that alerting on a fixed schedule if no alert was generated, or creating a simulation alert on a fixed schedule (both are rather similar solutions), might be a solution.
Ofer_Shezaf Thanks for your answer. unfortunately, I was expecting it. Still, how can an MSP guarantees to a client that those "not predictable" connectors are still "on"? The system/Azure/Azure Monitor/Log Analytics/Sentinel should have something that we could check via PowerShell, don't you think?
