Find your Microsoft Sentinel data connector

Supported by: Microsoft Corporation

Azure Activity Log is a subscription log that provides insight into subscription-level events that occur in Azure, including events from Azure Resource Manager operational data, service health events, write operations taken on the resources in your subscription, and the status of activities performed in Azure.

Log Analytics table(s):

Data collection rule support: Not currently supported

Supported by: Microsoft Corporation

The Azure DevOps Audit Logs data connector allows you to ingest audit events from Azure DevOps into Microsoft Sentinel. This data connector is built using the Microsoft Sentinel Codeless Connector Framework, ensuring seamless integration. It leverages the Azure DevOps Audit Logs API to fetch detailed audit events and supports DCR-based ingestion time transformations. These transformations enable parsing of the received audit data into a custom table during ingestion, improving query performance by eliminating the need for additional parsing. By using this connector, you can gain enhanced visibility into your Azure DevOps environment and streamline your security operations.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Prerequisites:

• Azure DevOps Prerequisite: Please ensure the following:
  1. Register an Entra App in Microsoft Entra Admin Center under App Registrations.
  2. In 'API permissions' - add Permissions to 'Azure DevOps - vso.auditlog'.
  3. In 'Certificates & secrets' - generate 'Client secret'.
  4. In 'Authentication' - add Redirect URI: 'https://portal.azure.cn/TokenAuthorize/ExtensionName/Microsoft_Azure_Security_Insights'.
  5. In the Azure DevOps settings - enable audit log and set View audit log for the user. Azure DevOps Auditing.
  6. Ensure the user assigned to connect the data connector has the View audit logs permission explicitly set to Allow at all times. This permission is essential for successful log ingestion. If the permission is revoked or not granted, data ingestion will fail or be interrupted.
  
  

Supported by: Microsoft Corporation

Connect to Azure Firewall. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

Azure Key Vault is a cloud service for securely storing and accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys. This connector lets you stream your Azure Key Vault diagnostics logs into Microsoft Sentinel, allowing you to continuously monitor activity in all your instances.

Log Analytics table(s):

Data collection rule support: Not currently supported

Supported by: Microsoft Corporation

Azure Kubernetes Service (AKS) is an open-source, fully-managed container orchestration service that allows you to deploy, scale, and manage Docker containers and container-based applications in a cluster environment. This connector lets you stream your Azure Kubernetes Service (AKS) diagnostics logs into Microsoft Sentinel, allowing you to continuously monitor activity in all your instances.

Log Analytics table(s):

Data collection rule support: Not currently supported

Supported by: Microsoft Corporation

Azure SQL is a fully managed, Platform-as-a-Service (PaaS) database engine that handles most database management functions, such as upgrading, patching, backups, and monitoring, without necessitating user involvement. This connector lets you stream your Azure SQL databases audit and diagnostic logs into Microsoft Sentinel, allowing you to continuously monitor activity in all your instances.

Log Analytics table(s):

Data collection rule support: Not currently supported

Supported by: Microsoft Corporation

Azure Storage account is a cloud solution for modern data storage scenarios. It contains all your data objects: blobs, files, queues, tables, and disks. This connector lets you stream Azure Storage accounts diagnostics logs into your Microsoft Sentinel workspace, allowing you to continuously monitor activity in all your instances, and detect malicious activity in your organization.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Prerequisites:

• Policy: Owner role assigned for each policy assignment scope
  
  

Supported by: Microsoft Corporation

Connect to the Azure Web Application Firewall (WAF) for Application Gateway, Front Door, or CDN. This WAF protects your applications from common web vulnerabilities such as SQL injection and cross-site scripting, and lets you customize rules to reduce false positives. Instructions to stream your Microsoft Web application firewall logs into Microsoft Sentinel are shown during the installation process.

Log Analytics table(s):

Data collection rule support: Not currently supported

Supported by: Microsoft Corporation

The Cisco ASA firewall connector allows you to easily connect your Cisco ASA logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Prerequisites:

• To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. Learn more
  
  

Supported by: Microsoft Corporation

Many applications log information to text or JSON files instead of standard logging services, such as Windows Event logs, Syslog or CEF. The Custom Logs data connector allows you to collect events from files on both Windows and Linux computers and stream them to custom logs tables you created. While streaming the data you can parse and transform the contents using the DCR. After collecting the data, you can apply analytic rules, hunting, searching, threat intelligence, enrichments and more.

NOTE: Use this connector for the following devices: Cisco Meraki, Zscaler Private Access (ZPA), VMware vCenter, Apache HTTP server, Apache Tomcat, Jboss Enterprise application platform, Juniper IDP, MarkLogic Audit, MongoDB Audit, Nginx HTTP server, Oracle Weblogic server, PostgreSQL Events, Squid Proxy, Ubiquiti UniFi, SecurityBridge Threat detection SAP and AI vectra stream.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Permissions: To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. Learn more
  
  

Supported by: Microsoft Corporation

The DNS log connector allows you to easily connect your DNS analytic and audit logs with Microsoft Sentinel, and other related data, to improve investigation.

When you enable DNS log collection you can:

• Identify clients that try to resolve malicious domain names.
• Identify stale resource records.
• Identify frequently queried domain names and talkative DNS clients.
• View request load on DNS servers.
• View dynamic DNS registration failures.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

The Microsoft 365 (formerly, Office 365) activity log connector provides insight into ongoing user activities. You will get details of operations such as file downloads, access requests sent, changes to group events, set-mailbox and details of the user who performed the actions. By connecting Microsoft 365 logs into Microsoft Sentinel you can use this data to view dashboards, create custom alerts, and improve your investigation process.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

Gain insights into Microsoft Entra ID by connecting Audit and Sign-in logs to Microsoft Sentinel to gather insights around Microsoft Entra ID scenarios. You can learn about app usage, conditional access policies, legacy auth relate details using our Sign-in logs. You can get information on your Self Service Password Reset (SSPR) usage, Microsoft Entra ID Management activities like user, group, role, app management using our Audit logs table.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

The Palo Alto Prisma Cloud CSPM data connector allows you to connect to your Palo Alto Prisma Cloud CSPM instance and ingesting Alerts (https://pan.dev/prisma-cloud/api/cspm/alerts/) & Audit Logs(https://pan.dev/prisma-cloud/api/cspm/audit-logs/) into Microsoft Sentinel.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to the workspace.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

Microsoft Sentinel integrates with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send the supported STIX object types from TAXII servers to Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

The Windows DNS log connector allows you to easily filter and stream all analytics logs from your Windows DNS servers to your Microsoft Sentinel workspace using the Azure Monitoring agent (AMA). Having this data in Microsoft Sentinel helps you identify issues and security threats such as:

• Trying to resolve malicious domain names.
• Stale resource records.
• Frequently queried domain names and talkative DNS clients.
• Attacks performed on DNS server.

You can get the following insights into your Windows DNS servers from Microsoft Sentinel:

• All logs centralized in a single place.
• Request load on DNS servers.
• Dynamic DNS registration failures.

Windows DNS events are supported by Advanced SIEM Information Model (ASIM) and stream data into the ASimDnsActivityLogs table. Learn more.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

Windows Firewall is a Microsoft Windows application that filters information coming to your system from the Internet and blocking potentially harmful programs. The software blocks most programs from communicating through the firewall. Users simply add a program to the list of allowed programs to allow it to communicate through the firewall. When using a public network, Windows Firewall can also secure the system by blocking all unsolicited attempts to connect to your computer.

Log Analytics table(s):

Data collection rule support: Not currently supported

Supported by: Microsoft Corporation

Windows Firewall is a Microsoft Windows application that filters information coming to your system from the internet and blocking potentially harmful programs. The firewall software blocks most programs from communicating through the firewall. To stream your Windows Firewall application logs collected from your machines, use the Azure Monitor agent (AMA) to stream those logs to the Microsoft Sentinel workspace.

A configured data collection endpoint (DCE) is required to be linked with the data collection rule (DCR) created for the AMA to collect logs. For this connector, a DCE is automatically created in the same region as the workspace. If you already use a DCE stored in the same region, it's possible to change the default created DCE and use your existing one through the API. DCEs can be located in your resources with SentinelDCE prefix in the resource name.

For more information, see the following articles:

• Data collection endpoints in Azure Monitor

Log Analytics table(s):

Data collection rule support: Not currently supported

Supported by: Microsoft Corporation

You can stream all Windows Event Forwarding (WEF) logs from the Windows Servers connected to your Microsoft Sentinel workspace using Azure Monitor Agent (AMA). This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

Microsoft Defender for Cloud is a security management tool that allows you to detect and quickly respond to threats across Azure, hybrid, and multi-cloud workloads. This connector allows you to stream your security alerts from Microsoft Defender for Cloud into Microsoft Sentinel, so you can view Defender data in workbooks, query it to produce alerts, and investigate and respond to incidents.

For more information>

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to the workspace.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR