Azure Activity Data Connector

Question

Hi All,&nbsp;My organization is currently working to stand up Sentinel and we are implementing our data connectors. However, we are unable to enable the Azure Activity data connector. All policies are written correctly and should be sending to Sentinel, but it is saying not connected.&nbsp;&nbsp;Any recommendations?

tungdra · Answer

Smittydude8822&nbsp;You can manually export the Activity Log to Log Analytics. This is what the remediate task does.&nbsp;https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#send-to-log-analytics-workspace&nbsp;

acheca · Answer

Smittydude8822&nbsp;Check if your policy scope is the resource group instead of the subscription. I made that mistake the first time deploying the connector in a similar situation than the one described.For it to work, the scope must be the susbscription.&nbsp;Hope this helps.

clive_watson · Answer

Smittydude8822&nbsp;&nbsp;How long have you waited so far, it can sometimes take an hour or more?Have you actually checked to see if data is being sent - I've seen cases where its shown as "not connected" but you do get data?&nbsp;

smittydude8822 · Answer

We've attempted to do this a few times over the past few weeks with no success. We've put the policy in place and waited over the period of time that has been suggested, but still no connection.

clive_watson · Answer

Did you do the remediation task ok? There is a step by step walkthrough here:https://intothecloudverse.com/2021/08/24/azure-activity-data-connector-for-azure-sentinel-issue-and-solution/

Forum Discussion

Azure Activity Data Connector

Share

Resources