This process will give you three pieces of information for use when deploying the Function App: the Graph tenant ID, the Graph client ID, and the Graph client secret (see the Application settings in the table above). To use this feature, you'll need to enable the Sentinel Threat Intelligence Platforms connector and also register an application in Azure Active Directory. The Agari Function App allows you to share threat intelligence with Microsoft Sentinel via the Security Graph API. If you perform this step, do this before you deploy your data connector. Required if enableSecurityGraphSharing is set to true (see below): enableSecurityGraphSharing (true/false see below).Single-click deployment via Azure Resource Manager (ARM) template.(Optional: Graph Tenant ID, Graph Client ID, Graph Client Secret).Agari Phishing Defense and Brand Protection (Preview) Connector attributeīefore deployment: Enable the Security Graph API (Optional).Īfter deployment: Assign necessary permissions to your Function App Prerequisites for each data connector are listed on the relevant data connector page in Microsoft Sentinel, on the Instructions tab. Data connector prerequisitesĮach data connector will have its own set of prerequisites, such as required permissions on your Azure workspace, subscription, or policy, and so on, or other requirements for the partner data source you're connecting to. The Azure Preview Supplemental Terms include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability. Noted Microsoft Sentinel data connectors are currently in Preview. Use Azure Functions to connect Microsoft Sentinel to your data sourceĬollect data from Linux-based sources using SyslogĬollect data in custom log formats to Microsoft Sentinel with the Log Analytics agent Get CEF-formatted logs from your device or appliance into Microsoft SentinelĬonnect your data source to the Microsoft Sentinel Data Collector API to ingest data The method that appears there will be a link to one of the following generic deployment procedures, which contain most of the information you'll need to connect your data sources to Microsoft Sentinel: Data ingestion methodĬonnect to Azure, Windows, Microsoft, and Amazon services The first piece of information you'll see for each connector is its data ingestion method.
HOW DO YOU FIND YOUR MICROSOFT WINDOWS LICENSE HOW TO
How to use this guideįirst, locate and select the connector for your product, service, or device in the headings menu to the right. You can also find other, community-built data connectors in the Microsoft Sentinel GitHub repository.
For more information, see the Microsoft Sentinel solutions catalog. Some data connectors are deployed only via solutions.