AMA data connector with existing DCR

Copper Contributor



We are in the process of migrating from MMA to AMA. We have prepared a central security DCR which collects Security Events and a association policy to make sure new subscription and VM's are automatically associated with the DCR. 
However in the Sentinel 'Windows Security Events via AMA' dataconnector I cannot select the existing DCR. 

I suppose I have to create the DCR via Sentinel but that poses new challenges:
- how to automatically onboard new subscriptions ot this DCR (I cannot select a managementgroup at sources)

- how to deploy this in code

Is there a way to connect the data connector to an existing DCR rule?


Regards, Erik

0 Replies