How do you delete a data connector

[sijmalik]

Hi,

Does anyone know how to delete a data connector from Sentinel, as I need to do this for testing?

I can't see any way of doing it in the portal (you used to be able to, but been deprecated I think :( )

I'm assuming I have to use HTTP and pass in the URI parameters. I tried this. As an example, I've got an Azure SQL Database connector that I want to delete. Where would I find the connector ID? I tried just putting in 'Azure SQL Database' in the connector ID parameter but I got a 204 code back.

Thanks

[#2 · Accepted solution]

@sijmalik You can't delete a data connector, you can just turn it off by disabling whatever mechanism is being used to import the data.

In the case of the Azure SQL you would delete the diagnostic setting that is sending the data into your Log Analytics workspace.

[#3]

@Gary Bushey OK, that makes perfect sense. Many thanks for your quick reply.

Cheers

[#4]

@Gary Bushey After deleting the diagnositic setting for Azure Activity, it still shows as connected even though logs have stopped. Is there any way to get it to recognise it is disconnected as it cannot be reconnected otherwise

[#5]

@John_Maton I think, and if anyone knows for sure please correct me, it is showing as connected because there is data in the tables that is has populated.   Once that data gets removed (and you can set table level retention to remove it after 30 days) it will no longer show as connected.

[#6]

AzureActivity may also data from other resources in there if people have turned on diagnostics settings elsewhere, that table can be a bit of a disaster depending on whats connected but you can summarize by resource group at least

Maybe have a look for entries since you disabled the Azure SQL logging and see if anything else is pushing data in

AzureActivity
| where TimeGenerated > ago(2d)
| summarize count()by ResourceGroup