Azure Sentinel – Data connectors

Azure Sentinel is a cloud-native security information and event management (SIEM) service that provides intelligent security analytics and threat intelligence across your enterprise. It can ingest data from various sources to detect and investigate security threats.

Steps to configure data connectors in Azure Sentinel:

1. Navigate to Azure Sentinel:
   • Log in to the Azure portal and navigate to the Azure Sentinel service.
   • Select the workspace where you want to configure the data connector.
2. Select a data connector:
   • Click on “Data connectors” in the left-hand menu and select the data connector you want to configure.
   • Azure Sentinel supports various data connectors, including Microsoft 365, Azure Active Directory, Azure Activity Logs, Azure Security Center, and more.
3. Configure the data connector:
   • Follow the on-screen instructions to configure the data connector.
   • Depending on the data connector, you may need to provide credentials, specify log types, set up alerts, and enable continuous export.
4. Test the data connector:
   • After you have configured the data connector, you can test it to ensure it is ingesting data correctly.
   • Navigate to the “Test” tab in the data connector configuration and follow the instructions to test the data connector.
   • You can also view the ingestion status and data volume in the “Status” tab.
5. Monitor data ingestion:
   • Once the data connector is configured and tested, you can monitor the data ingestion in Azure Sentinel.
   • Navigate to the “Logs” blade in Azure Sentinel and select the data connector to view the ingested data.
   • You can also create queries and workbooks to visualise the data and set up alerts to detect anomalies.

That’s it! You can now configure data connectors in Azure Sentinel to ingest data from various sources and detect security threats across your enterprise.

Some of the data connectors available in Azure Sentinel:

1. Microsoft 365:
   • Microsoft 365 data connector enables you to collect audit logs from various Microsoft 365 services such as Exchange Online, SharePoint Online, OneDrive for Business, Teams, and more.
2. Azure Active Directory:
   • Azure Active Directory data connector allows you to collect audit logs and sign-in logs from Azure Active Directory.
3. Azure Activity Logs:
   • Azure Activity Logs data connector enables you to collect activity logs from various Azure services, including virtual machines, storage accounts, and more.
4. Azure Security Center:
   • Azure Security Center data connector allows you to collect security recommendations and alerts from Azure Security Center.
5. Syslog:
   • Syslog data connector enables you to collect log data from various sources that use the syslog protocol, including Linux machines, network devices, and more.
6. Common Event Format (CEF):
   • CEF data connector allows you to collect log data from various sources that use the CEF format, including security devices, firewalls, and more.
7. Windows Event Logs:
   • Windows Event Logs data connector enables you to collect event logs from Windows servers and desktops.
8. Azure Monitor:
   • Azure Monitor data connector allows you to collect diagnostic logs and metrics from various Azure services, including virtual machines, storage accounts, and more.
9. Custom logs:
   • Custom logs data connector enables you to collect log data from any source that supports sending logs to a syslog server or an HTTP endpoint.

You can configure these data connectors to ingest data into Azure Sentinel and use it to detect and investigate security threats across your enterprise.