I have two problems that I don't really know if they are related. I put you in context.
I'm teaching a course, and it happens to ALL of us, it's not my team thing.
We save a function in Sentinel to parse Sysmon, which is normal. In some cases a day, two days, it disappears. it has happened to all of us.
On the other hand, we use the old security event connector, to send logs from 2019 onpremises servers to Sentinel.
We configure them, we add the sysmon option in the agent options, everything is perfect.
a day, at hours, the connector in sentinel stops working, it tells us disconnected. The sysmon configuration disappears in the agent, and in the connector, where it says ALL events, NONE appears.
that is, every day we have to restart the process of using the agent to send the logs.
I understand that they are two different problems, but I am unifying them in case they are related.
Thanks in advance.
To go further, is there a log in sentinel where it tells me who has modified a data connector?
Is there a log in sentinel that tells me who or when a function has been deleted?
