| title | description | author | ms.topic | ms.date | ms.author | appliesto | ms.collection | ||
|---|---|---|---|---|---|---|---|---|---|
Connect your data sources to Microsoft Sentinel by using data connectors |
Learn how to install and configure a data connector in Microsoft Sentinel. |
cwatson-cat |
how-to |
03/28/2024 |
cwatson |
|
usx-security |
Install and configure data connectors to ingest your data into Microsoft Sentinel. Data connectors are available as part of solutions from the content hub in Microsoft Sentinel. After you install a solution from the content hub, the related data connectors are available to enable and configure. To find and install solutions that include data connectors, see Discover and manage Microsoft Sentinel out-of-the-box content.
This article provides general information about how to enable a data connector and how to find more detailed installation instructions for other data connectors. For more information about data connectors in Microsoft Sentinel, see the following articles:
[!INCLUDE unified-soc-preview]
Before you begin, make sure you have the appropriate access and you or someone in your organization installs the related solution.
- You must have read and write permissions on the Microsoft Sentinel workspace.
- Install the solution that includes the data connector from the Content Hub in Microsoft Sentinel. For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.
After you or someone in your organization installs the solution that includes the data connector you need, configure the data connector to start ingesting data.
-
For Microsoft Sentinel in the Azure portal, under Configuration, select Data connectors.
For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Configurations > Data connectors. -
Search for and select the connector. If you don't see the data connector you want, install the solution associated with it from the Content Hub.
-
Select Open connector page.
:::image type="content" source="media/configure-data-connector/open-connector-page-option.png" alt-text="Screenshot of data connector details page with open connector page button.":::
:::image type="content" source="media/configure-data-connector/open-connector-page-option-defender-portal.png" alt-text="Screenshot of data connector details page in the Defender portal.":::
-
Review the Prerequisites. To configure the data connector, fulfill all the prerequisites.
-
Follow the steps outlined in the Configurations section.
For some connectors, find more specific configuration information in the Collect data section in the Microsoft Sentinel documentation. For example, see the following articles:
- Connect Microsoft Sentinel to Azure, Windows, Microsoft, and Amazon services
- Find your Microsoft Sentinel data connector
After you configure the data connector, it might take some time for the data to be ingested into Microsoft Sentinel. When the data connector is connected, you see a summary of the data in the Data received graph, and the connectivity status of the data types.
:::image type="content" source="media/configure-data-connector/connected-data-connector.png" alt-text="Screenshot of a data connector page with status connected and graph that shows the data received.":::
Both Microsoft and other organizations author Microsoft Sentinel data connectors. Find the support contact from data connector page in Microsoft Sentinel.
-
In the Microsoft Sentinel Data connectors page, select the relevant connector.
-
To access support and maintenance for the connector, use the support contact link in the Supported by field on the side panel for the connecter.
:::image type="content" source="media/configure-data-connector/support.png" alt-text="Screenshot showing the Supported by field for a data connector in Microsoft Sentinel." lightbox="media/configure-data-connector/support.png":::
For more information, see Data connector support.
For more information about solutions and data connectors in Microsoft Sentinel, see the following articles.