Forum Discussion

Dean_Gross's avatar
Dean_Gross
Silver Contributor
Nov 01, 2021
Solved

Finding changes to connectors

How can I find out who added or removed a connector in Azure Sentinel. I am not able to find this event in the Azure Activity log. Am I looking in the wrong place?

  • Rod_Trent's avatar
    Rod_Trent
    Nov 01, 2021
    Use the following...

    AzureActivity
    | where OperationNameValue contains "MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS"
    | distinct OperationNameValue

1 Reply

  • Rod_Trent's avatar
    Rod_Trent
    Icon for Microsoft rankMicrosoft
    Nov 01, 2021
    Use the following...

    AzureActivity
    | where OperationNameValue contains "MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS"
    | distinct OperationNameValue