Connecting data to Microsoft Sentinel using data connectors

Connecting data to Microsoft Sentinel using data connectors involves selecting the appropriate connector for the data source, configuring the connection, and ensuring that data flows correctly into Sentinel’s workspace. Here’s a step-by-step guide:

---

Step 1: Access Microsoft Sentinel

1. Log in to the Azure portal.
2. Navigate to Microsoft Sentinel.
3. Select the Sentinel workspace you want to connect your data to.

---

Step 2: Open the Data Connectors Page

1. In the Sentinel workspace, go to the Data connectors option under the Configuration section.
2. Browse the list of available connectors or use the search bar to find the connector for your desired data source.

---

Step 3: Select a Data Connector

1. Click on the data connector you want to configure (e.g., Microsoft 365 Defender, AWS CloudTrail, Azure Activity Logs, or Syslog).
2. Review the connector documentation to understand:
   • Prerequisites (e.g., permissions, licenses).
   • Steps for setup.

---

Step 4: Configure the Connector

A. Built-In Connectors (Cloud Services)

For cloud services like Microsoft 365 Defender or AWS CloudTrail:

1. Follow the setup instructions in the connector interface.
2. Provide the required details such as:
   • Tenant ID, subscription ID (for Azure-based services).
   • API credentials or tokens (for third-party services like AWS or Salesforce).
3. Enable the connector by clicking Connect.

---

B. Syslog or Common Event Format (CEF) Connectors

For on-premises systems or devices:

1. Set up a Log Forwarding Server:
   • Create a Linux-based virtual machine in Azure to act as the Syslog or CEF collector.
   • Install the required Log Analytics agent on the VM.
2. Configure the Source Device:
   • Configure your firewall, router, or other device to forward logs to the Syslog server.
   • Use the IP address of the Azure VM and ensure logs are sent in Syslog or CEF format.
3. Validate the Connection:
   • Check the Sentinel workspace for ingested logs under Logs > Syslog or CommonSecurityLog.

---

C. API-Based Connectors

For services like ServiceNow, Okta, or Palo Alto Networks:

1. Follow the documentation to generate API keys, tokens, or authentication credentials.
2. Enter the required credentials in the connector configuration.
3. Test the connection and validate data ingestion.

---

Step 5: Verify Data Ingestion

1. Once the connector is set up, go to the Logs section in the Sentinel workspace.
2. Use queries to check if data is being ingested:
   • Example query for Azure Activity Logs:

     AzureActivity
     | summarize Count = count() by Category
     

   • Example query for Syslog:

     Syslog
     | take 10
     

---

Step 6: Configure Analytics Rules (Optional)

1. Go to the Analytics section in Sentinel.
2. Enable built-in rules or create custom detection rules based on the ingested data.

---

Common Data Connectors

• Azure-based Services: Azure Activity Logs, Azure AD Identity Protection, Azure Security Center.
• Third-Party Services: AWS CloudTrail, Palo Alto Networks, Cisco ASA, Fortinet.
• Syslog/CEF: For on-premises firewalls, intrusion detection systems, and more.

---

Let me know if you need step-by-step help for a specific data source!