data-connectors-reference.md

title

description

author

ms.topic

ms.date

ms.custom

ms.author

appliesto

ms.collection

Find your Microsoft Sentinel data connector | Microsoft Docs

Learn about specific configuration steps for Microsoft Sentinel data connectors.

cwatson-cat

reference

07/03/2024

linux-related-content

cwatson

Microsoft Sentinel in the Azure portal

Microsoft Sentinel in the Microsoft Defender portal

usx-security

Find your Microsoft Sentinel data connector

This article lists all supported, out-of-the-box data connectors and links to each connector's deployment steps.

Important

Noted Microsoft Sentinel data connectors are currently in Preview. The Azure Preview Supplemental Terms include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
For connectors that use the Log Analytics agent, the agent will be retired on 31 August, 2024. If you are using the Log Analytics agent in your Microsoft Sentinel deployment, we recommend that you migrate to the the Azure Monitor Agent (AMA). For more information, see AMA migration for Microsoft Sentinel.
[!INCLUDE unified-soc-preview-without-alert]

Data connectors are available as part of the following offerings:

Solutions: Many data connectors are deployed as part of Microsoft Sentinel solution together with related content like analytics rules, workbooks, and playbooks. For more information, see the Microsoft Sentinel solutions catalog.
Community connectors: More data connectors are provided by the Microsoft Sentinel community and can be found in the Azure Marketplace. Documentation for community data connectors is the responsibility of the organization that created the connector.
Custom connectors: If you have a data source that isn't listed or currently supported, you can also create your own, custom connector. For more information, see Resources for creating Microsoft Sentinel custom connectors.

[!INCLUDE reference-to-feature-availability]

Data connector prerequisites

[!INCLUDE data-connector-prereq]

Syslog and Common Event Format (CEF) connectors

Log collection from many security appliances and devices are supported by the data connectors Syslog via AMA or Common Event Format (CEF) via AMA in Microsoft Sentinel. To forward data to your Log Analytics workspace for Microsoft Sentinel, complete the steps in Ingest syslog and CEF messages to Microsoft Sentinel with the Azure Monitor Agent. These steps include installing the Microsoft Sentinel solution for a security appliance or device from the Content hub in Microsoft Sentinel. Then, configure the Syslog via AMA or Common Event Format (CEF) via AMA data connector that's appropriate for the Microsoft Sentinel solution you installed. Complete the setup by configuring the security device or appliance. Find instructions to configure your security device or appliance in one of the following articles:

Contact the solution provider for more information or where information is unavailable for the appliance or device.

Codeless connector platform connectors

The following connectors use the current codeless connector platform but don't have a specific documentation page generated. They're available from the content hub in Microsoft Sentinel as part of a solution. For instructions on how to configure these data connectors, review the instructions available with each data connectors within Microsoft Sentinel.

Codeless connector name	Azure Marketplace solution
Atlassian Jira Audit (using REST API) (Preview)	Atlassian Jira Audit
Cisco Meraki (using Rest API)	Cisco Meraki Events via REST API
Ermes Browser Security Events	Ermes Browser Security for Microsoft Sentinel
Okta Single Sign-On (Preview)	Okta Single Sign-On Solution
Sophos Endpoint Protection (using REST API) (Preview)	Sophos Endpoint Protection Solution
Workday User Activity (Preview)	Workday (Preview)