SOLVED

Finding changes to connectors

Respected Contributor

How can I find out who added or removed a connector in Azure Sentinel. I am not able to find this event in the Azure Activity log. Am I looking in the wrong place?

1 Reply
best response confirmed by Dean Gross (Respected Contributor)
Solution
Use the following...

AzureActivity
| where OperationNameValue contains "MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS"
| distinct OperationNameValue