About Data Connectors

After on-boarding, first we need to start ingesting data from different sources into Microsoft Sentinel.

Microsoft Sentinel comes with several data connectors for Microsoft and non-Microsoft products to help get your data onboarded. These data connectors are available out of the box and provide real-time integration with products including Microsoft 365 Defender, Microsoft 365 sources, Azure AD, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and more. In addition, there are built-in connectors to the broader security ecosystem for non-Microsoft products.

Connector types:

• Connectors from Microsoft
• Connectors from third party vendors (partners)
• Custom connectors that we can create using:
  • Common Event Format (CEF)
  • Syslog
  • REST-API

Azure Activity

Azure Active Directory

Required roles:

• “Contributor” role at scope of Subscription or Resource Group or Log Analytics Workspace
• “Security Administrator” role in Azure AD

Azure Firewall

Web Application Firewall