Finding changes to connectors

[Dean Gross]

How can I find out who added or removed a connector in Azure Sentinel. I am not able to find this event in the Azure Activity log. Am I looking in the wrong place?

[#2 · Accepted solution]

Use the following...

AzureActivity
| where OperationNameValue contains "MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS"
| distinct OperationNameValue