Find your Microsoft Sentinel data connector

Supported by: 1Password

The 1Password solution for Microsoft Sentinel enables you to ingest sign-in attempts, item usage, and audit events from your 1Password Business account using the 1Password Events Reporting API. This allows you to monitor and investigate events in 1Password in Microsoft Sentinel along with the other applications and services your organization uses.

Underlying Microsoft Technologies used:

This solution depends on the following technologies, and some of which may be in Preview state or may incur additional ingestion or operational costs:

• Azure Functions

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Prerequisites:

• Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. For more information, see Azure Functions.
• 1Password Events API Token: A 1Password Events API Token is required. For more information, see the 1Password API.

Note: A 1Password Business account is required

Setup Instructions:

NOTE: This connector uses Azure Functions to connect to 1Password to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs from Azure. Check the Azure Functions pricing page for details.

(Optional Step) Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. Follow these instructions to use Azure Key Vault with an Azure Function App.

STEP 1 - Configuration steps for the 1Password Events Reporting API

Follow these instructions provided by 1Password to obtain an Events Reporting API Token. Note: A 1Password Business account is required

STEP 2 - Deploy the functionApp using DeployToAzure button to create the table, dcr and the associated Azure Function

IMPORTANT: Before deploying the 1Password connector, a custom table needs to be created.

Option 1 - Azure Resource Manager (ARM) Template

This method provides an automated deployment of the 1Password connector using an ARM Tempate.

1. Click the Deploy to Azure button below.

   aka.ms

2. Select the preferred Subscription, Resource Group and Location.

3. Enter the Workspace Name, Workspace Name, 1Password Events API Key, and URI.

• The default Time Interval is set to five (5) minutes. If you'd like to modify the interval, you can adjust the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion.
• Note: If using Azure Key Vault secrets for any of the values above, use the@Microsoft.KeyVault(SecretUri={Security Identifier})schema in place of the string values. Refer to Key Vault references documentation for further details.

4. Mark the checkbox labeled I agree to the terms and conditions stated above.
5. Click Purchase to deploy.

Supported by: 1Password

The 1Password CCF connector allows the user to ingest 1Password Audit, Signin & ItemUsage events into Microsoft Sentinel.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Prerequisites:

• 1Password API token: A 1Password API Token is required. See the 1Password documentation on how to create an API token.

Setup Instructions:

STEP 1 - Create a 1Password API token:

Follow the 1Password documentation for guidance on this step.

STEP 2 - Choose the correct base URL:

There are multiple 1Password servers which might host your events. The correct server depends on your license and region. Follow the 1Password documentation to choose the correct server. Input the base URL as displayed by the documentation (including 'https://' and without a trailing '/').

STEP 3 - Enter your 1Password Details:

Enter the 1Password base URL & API Token below:

• Base Url: (Enter your Base Url)
• API Token: (Enter your API Token)
• Enable/Disable Connection

Supported by: Microsoft Corporation

Connects the 42Crunch API protection to Microsoft Sentinel via the Azure Monitor DCE/DCR REST API interface. The integration uses Docker containers (API Firewall and Log Forwarder) to forward API traffic logs to Microsoft Sentinel for threat detection and analysis.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Microsoft.Insights/dataCollectionEndpoints: Data Collection Endpoint is required for the modern push connector to receive data from the external security system.
• Microsoft.Insights/dataCollectionRules: Data Collection Rule is required to define the schema and transformations for incoming data.
• Microsoft.Authorization/roleAssignments: Role assignment is required to grant the Entra application permissions to send data to the Data Collection Rule.
• 42Crunch API Firewall requirement: The 42Crunch API Firewall and Log Forwarder Docker containers must be deployed and running. Obtain your API Firewall token (42C_FIREWALL_TOKEN) and platform URL (42C_PLATFORM_URL) from the 42Crunch platform at https://platform.42crunch.com. Full deployment instructions are available at https://github.com/42Crunch/azure-sentinel-integration.

Setup Instructions:

1. Create ARM Resources and Provide the Required Permissions

This connector receives data from external security systems that push logs to Microsoft Sentinel. The external system must be configured to send raw event data to the Microsoft Sentinel Ingestion API. Clicking on Deploy will trigger the creation of Log Analytics tables and a Data Collection Rule (DCR). It will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token.

Learn more about the connector setup process

Azure Resource Deployment

The deployment process will create the following resources:

• Log Analytics custom table(s)
• Data Collection Endpoint (DCE)
• Data Collection Rule (DCR)
• Entra ID Application Registration
• Role assignments for data ingestion

Configuration Values

After deployment, copy the following values to configure your external security system:

• Tenant ID (Directory ID): <variable value provided at install time>
• Entra App Registration Application ID: <variable value provided at install time>
• Entra App Registration Secret: <variable value provided at install time>
• Data Collection Endpoint Url: <variable value provided at install time>
• Data Collection Rule Immutable ID: <variable value provided at install time>
• Stream Name (FortyTwoCrunchAPIProtectionV2): <variable value provided at install time>

Note: Keep these values secure. You will need them to configure your external security system.

2. Configure your external system to push logs

Use the following parameters to configure your external security system to send logs to the workspace.

Configuration Steps

1. Access your external security system's configuration interface.
2. Navigate to the data forwarding, integration, or SIEM settings.
3. Select Azure Monitor or Microsoft Sentinel as the destination.
4. Select Data Collection Endpoint as the authentication method.
5. Configure the required fields using the values from the previous step:
   • Tenant ID: Copy from above
   • Application (Client) ID: Copy from above
   • Client Secret: Copy from above
   • Data Collection Endpoint: Copy from above
   • Data Collection Rule Immutable ID: Copy from above
   • Stream Name: Copy the appropriate stream name from above
6. Save the configuration and enable/start the forwarder.

Validation

Note: Data will appear in the FortyTwoCrunchAPIProtectionV2 table in your Log Analytics workspace within a few minutes.

To verify data is being received, run the following query in your Log Analytics workspace:

FortyTwoCrunchAPIProtectionV2
| where TimeGenerated > ago(1h)
| take 10

Troubleshooting

If data is not appearing:

• Verify the configuration values are correct

• Check that the forwarder/integration is enabled and running

• Review logs in your external security system for any errors

• Ensure network connectivity from your system to Azure

• Verify the Entra application has the correct permissions

  After deploying the Azure resources, configure the 42Crunch Log Forwarder Docker container to send data to the deployed DCE/DCR endpoints instead of the legacy HTTP Data Collector API.

Update Docker Compose / Helm Chart Environment Variables

Note: This step applies if you already have an existing 42Crunch Log Forwarder deployment using the legacy HTTP Data Collector API. Migrate it by replacing the legacy WORKSPACE_ID and WORKSPACE_KEY environment variables with the new DCE/DCR configuration:

environment:
Legacy (remove these):
- WORKSPACE_ID=<workspace-id>
- WORKSPACE_KEY=<primary-key>

New CCF Push Connector configuration:
  - DCE_ENDPOINT=<data-collection-endpoint-url>
  - DCR_IMMUTABLE_ID=<data-collection-rule-immutable-id>
  - DCR_STREAM_NAME=Custom-FortyTwoCrunchAPIProtectionV2_CL

42Crunch platform credentials (unchanged):
  - 42C_FIREWALL_TOKEN=<your-firewall-token>
  - 42C_PLATFORM_URL=<your-platform-url>

Note: If you don't have an existing Docker deployment or need an example to follow, use the steps below.

1. Download the sample deployment

Download the sample-deployment folder from the Azure-Sentinel repository. It contains the docker-compose.yml, .env.example, and log forwarder used to send data to Microsoft Sentinel.

2. Create your .env file

Copy .env.example to .env and fill in your values before running docker compose up.

• By default this sample runs in online mode and requires a 42Crunch platform token.
• To run in offline mode (no token required), set PROTECTION_TOKEN=NOTUSED and uncomment PLATFORM_CONNECTIVITY=NONE in docker-compose.yml.

SECURITY: Do NOT put CLIENT_SECRET in the .env file. Pass it as a shell environment variable instead. Docker Compose merges shell environment variables with the .env file automatically.

PowerShell
$env:CLIENT_SECRET = (Read-Host -Prompt "CLIENT_SECRET" -AsSecureString | ConvertFrom-SecureString -AsPlainText)
docker compose up --build

Bash/Linux
read -rs CLIENT_SECRET && export CLIENT_SECRET
docker compose up --build

3. Obtain your 42Crunch protection token

From the 42Crunch platform (platform.42crunch.com):

• Online mode: get the token from Protect > your API > Protection > Firewall Instances > Add instance.

• Offline mode (no platform account): set PROTECTION_TOKEN=NOTUSED and uncomment PLATFORM_CONNECTIVITY=NONE in docker-compose.yml.

  The DCE endpoint URL and DCR immutable ID are displayed after deploying the ARM resources in Step 1. For full configuration details, refer to the 42Crunch Microsoft Sentinel Integration documentation.

  For a complete migration guide, see the 42Crunch API Protection Migration Guide.

Important: Connection Status

This is a push-based connector - it receives data from the 42Crunch Log Forwarder and does not maintain an active polling connection. The connector shows as Connected when data has been received within the last 7 days.

Uninstall connector

Follow these steps to disconnect and delete the connector instance.

Delete the Connector Instance

1. To disconnect the connector and revoke its access, select the Revoke access button.
2. Return to the Data connectors page, select the connector's overflow menu (the three dots), and choose Delete to remove the connector instance.
3. Navigate to the Content hub, locate the corresponding solution, and delete it to complete the removal.

This removes the push connector instance. Historical data in your Log Analytics workspace will be retained.

Supported by: Abnormal Security

The Abnormal Security connector pushes real-time security events (threats, cases, audit logs, abuse mailbox reports, posture changes, ATO cases, remediations, and vendor cases) from Abnormal's cloud email security platform into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. Events are routed to per-event-type tables matching the legacy connector naming convention, enabling seamless migration.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Prerequisites:

• Microsoft Entra: Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher.
• Microsoft Azure: Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role.
• Abnormal Security: Active Abnormal Security subscription with access to the SIEM integration settings.

Setup Instructions:

1. Deploy Connector Resources

This connector enables Abnormal Security to push real-time security events directly to Microsoft Sentinel via the Azure Monitor Ingestion API.

Automated Configuration Clicking Deploy will create:

• 9 custom log tables for per-event-type routing
• Data Collection Rule (DCR) with 9 streams
• Data Collection Endpoint (DCE) for ingestion
• Microsoft Entra application with OAuth credentials
• Required IAM role assignments (Monitoring Metrics Publisher)

This enables Abnormal Security to securely push events using OAuth 2.0 client credentials.

2. Configure Abnormal Security

Use the following parameters to configure the Microsoft Sentinel integration in the Abnormal Security Portal.

• Tenant ID (Directory ID): <variable value provided at install time>
• Application (Client) ID: <variable value provided at install time>
• Client Secret: <variable value provided at install time>
• Data Collection Endpoint URI: <variable value provided at install time>
• Data Collection Rule Immutable ID: <variable value provided at install time> Configure in Abnormal Security Portal

1. Log in to Abnormal Security Portal
2. Navigate to Settings > Integrations > SIEM
3. Select Microsoft Sentinel (Azure Monitor CCF)
4. Enter all 7 values from above
5. Click Verify Credentials to test the connection
6. Click Save and Enable the integration Multi-table routing: Events are automatically routed to per-event-type tables (e.g., threat logs → ABNORMAL_SECURITY_THREAT_LOG_CL, cases → ABNORMAL_SECURITY_CASE_CL). Unknown event types go to the fallback table ABNORMAL_SECURITY_LOGS_CL.

3. Verify Data Ingestion

Confirm events are flowing from Abnormal Security to Sentinel.

Wait 5-10 minutes after enabling the integration, then run this KQL query:

union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc

If no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors.

Supported by: Abnormal Security

The Abnormal Security data connector provides the capability to ingest threat and case logs into Microsoft Sentinel using the Abnormal Security Rest API.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Prerequisites:

• Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. For more information, see Azure Functions.
• Abnormal Security API Token: An Abnormal Security API Token is required. For more information, see Abnormal Security API. Note: An Abnormal Security account is required

Setup Instructions:

NOTE: This connector uses Azure Functions to connect to Abnormal Security's REST API to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the Azure Functions pricing page for details.

STEP 1 - Configuration steps for the Abnormal Security API

Follow these instructions provided by Abnormal Security to configure the REST API integration. Note: An Abnormal Security account is required

STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function

IMPORTANT: Before deploying the Abnormal Security data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Abnormal Security API Authorization Token, readily available.

• Workspace ID: <variable value provided at install time>
• Primary Key: <variable value provided at install time>

Option 1 - Azure Resource Manager (ARM) Template

This method provides an automated deployment of the Abnormal Security connector using an ARM Template.

1. Click the Deploy to Azure button below.

   aka.ms

2. Select the preferred Subscription, Resource Group and Location.

3. Enter the Microsoft Sentinel Workspace ID, Microsoft Sentinel Shared Key and Abnormal Security REST API Key.

• The default Time Interval is set to pull the last five (5) minutes of data. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion.

4. Mark the checkbox labeled I agree to the terms and conditions stated above.
5. Click Purchase to deploy.

Option 2 - Manual Deployment of Azure Functions

Use the following step-by-step instructions to deploy the Abnormal Security data connector manually with Azure Functions (Deployment via Visual Studio Code).

1. Deploy a Function App

NOTE: You will need to prepare VS code for Azure function development.

1. Download the Azure Function App file. Extract archive to your local development computer.

2. Start VS Code. Choose File in the main menu and select Open Folder.

3. Select the top level folder from extracted files.

4. Choose the Azure icon in the Activity bar, then in the Azure: Functions area, choose the Deploy to function app button. If you aren't already signed in, choose the Azure icon in the Activity bar, then in the Azure: Functions area, choose Sign in to Azure If you're already signed in, go to the next step.

5. Provide the following information at the prompts:

   a. Select folder: Choose a folder from your workspace or browse to one that contains your function app.

   b. Select Subscription: Choose the subscription to use.

   c. Select Create new Function App in Azure (Don't choose the Advanced option)

   d. Enter a globally unique name for the function app: Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. AbnormalSecurityXX).

   e. Select a runtime: Choose Python 3.11.

   f. Select a location for new resources. For better performance and lower costs choose the same region where Microsoft Sentinel is located.

6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.

7. Go to Azure Portal for the Function App configuration.

8. Configure the Function App

9. In the Function App, select the Function App Name and select Configuration.

10. In the Application settings tab, select + New application setting.

11. Add each of the following application settings individually, with their respective string values (case-sensitive): SENTINEL_WORKSPACE_ID SENTINEL_SHARED_KEY ABNORMAL_SECURITY_REST_API_TOKEN logAnalyticsUri (optional) (add any other settings required by the Function App) Set the uri value to: <add uri value>

Note: If using Azure Key Vault secrets for any of the values above, use the@Microsoft.KeyVault(SecretUri={Security Identifier})schema in place of the string values. Refer to Azure Key Vault references documentation for further details.

• Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: https://<CustomerId>.ods.opinsights.azure.us.

4. Once all application settings have been entered, click Save.

Supported by: Microsoft Corporation

Agent 365 data connector gives richer insights into AI agent activity by bringing AI agent telemetry from Agent 365, AI Foundry, and Copilot in the Microsoft Sentinel data lake to investigate agent behavior, tool usage, and execution with hunting, graph, and MCP workflows. Data from this connector is used to investigate AI agent behavior, tool usage, and execution in Microsoft Sentinel. If you have enabled these workflows, deactivating this connector will prevent those investigations from being performed.

Log Analytics table(s):

Data collection rule support: Not currently supported

Setup Instructions:

Supported by: Microsoft Corporation

The Airlock Digital connector collects application control and execution logs from your Airlock Digital server, providing visibility into file executions, server activities, and security event summaries in Microsoft Sentinel.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Airlock Digital API Key: API Key with read access to logging endpoints. Generate from Airlock Digital Web UI: User Menu > Settings > API Keys.

Setup Instructions:

1. Configure Airlock Digital API Access

Provide API connection details for Airlock Digital

Before you begin:

• Access to your Airlock Digital server
• API Key from Airlock Digital (User Menu > Settings > API Keys)
• Server must be accessible from Azure (ensure firewall allows connections)

Base URL: Enter your Airlock Digital server URL. Default port is 3129 for REST API. Example: https://airlock.company.com:3129

The connector collects:

• Server Activities: Administrative actions, policy changes, agent check-ins, and repository updates
• Execution Histories: File execution events including blocked, audited, and trusted executions with file hashes, publishers, and user details
• File Activity Summary: Aggregated statistics on file activity, security events, and execution trends Data refresh: Logs are retrieved every 5 minutes. Data should appear within 5-10 minutes after connection.

2. Connect Airlock Digital servers to Microsoft Sentinel

This connector supports multiple simultaneous connections. Add one connection per Airlock Digital server; each connection ingests the selected data types in parallel. Use the grid below to review existing connections or add a new one.

• Data Connectors Grid (configure in portal)

Supported by: AIShield

AIShield connector allows users to connect with AIShield custom defense mechanism logs with Microsoft Sentinel, allowing the creation of dynamic Dashboards, Workbooks, Notebooks and tailored Alerts to improve investigation and thwart attacks on AI systems. It gives users more insight into their organization's AI assets security posturing and improves their AI systems security operation capabilities.AIShield.GuArdIan analyzes the LLM generated content to identify and mitigate harmful content, safeguarding against legal, policy, role based, and usage based violations

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Note: Users should have utilized AIShield SaaS offering to conduct vulnerability analysis and deployed custom defense mechanisms generated along with their AI asset. Click here to know more or get in touch.

Setup Instructions:

NOTE: This data connector depends on a parser based on a Kusto Function to work as expected AIShield which is deployed with the Microsoft Sentinel Solution.

IMPORTANT: Before deploying the AIShield Connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).

• Workspace ID: <variable value provided at install time>
• Primary Key: <variable value provided at install time>

Supported by: Microsoft Corporation

The Akamai SIEM Connector ingests web application firewall (WAF) security events from the Akamai SIEM Integration API into Microsoft Sentinel. The connector collects detailed security event data including attack information, geographic context, and HTTP request/response metadata. Authentication uses Akamai EdgeGrid - provide your three EdgeGrid credentials (client_token, access_token, client_secret) plus the API hostname from your .edgerc file. The platform runtime computes a fresh HMAC-SHA-256 signed Authorization header on every poll request per the EdgeGrid specification.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Akamai EdgeGrid API Credentials: Client Token, Access Token, and Client Secret are required for EdgeGrid HMAC-SHA-256 authentication. These credentials are generated from the Akamai Control Center under Identity & Access > API Clients.

Setup Instructions:

Step 1 - Enable Data Collection for SIEM in Akamai Security Center

Turn on SIEM integration in your Akamai security configuration and note the Web Security Configuration ID.

1. Log in to Akamai Security Center.
2. Select your security configuration and open the SIEM Integration section.
3. Set Data collection for SIEM to On.
4. Under Turn on SIEM integration for, select the security policies to monitor (or choose All Security Policies).
5. Choose a SIEM Event Version (SIEM Version 01 is recommended).
6. Copy the Web Security Configuration ID shown on the page - you will need it in Step 3 below.

Step 2 - Provision EdgeGrid API credentials

Create an Akamai EdgeGrid API client with the Manage SIEM role and download the .edgerc credentials file.

1. In Akamai Control Center, go to Identity & Access > Users.
2. Create a new user (or select an existing service account) and assign the Manage SIEM role.
3. Go to Identity & Access > API Clients and click Create API client > Quick.
4. Select the SIEM API service and grant READ access.
5. Click Create and then Download to save the .edgerc file.
6. The .edgerc file contains the four values you will enter in Step 3:

[default]
client_secret = <your-client-secret>
host = <your-host>.luna.akamaiapis.net
access_token = akab-<your-access-token>
client_token = akab-<your-client-token>

The connector platform computes a fresh HMAC-SHA-256 signed Authorization header on every poll - you do not need to sign anything manually.

Step 3 - Connect Akamai SIEM to Microsoft Sentinel

Multi-tenant support: This connector supports ingesting security events from multiple Akamai security configurations in parallel. Click Add Connection once per configuration, supplying that configuration's EdgeGrid credentials, hostname, and Config ID. Each connection is tracked and managed independently in the grid below.

• Data Connectors Grid (configure in portal)

Supported by: Microsoft Corporation

The Alibaba Cloud ActionTrail data connector provides the capability to retrieve actiontrail events stored into Alibaba Cloud Simple Log Service and store them into Microsoft Sentinel through the SLS REST API. The connector enables event retrieval to assess potential security risks, monitor collaboration, and diagnose and troubleshoot configuration issues.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Prerequisites:

• SLS REST API Credentials/permissions: AliCloudAccessKeyId and AliCloudAccessKeySecret are required for making API calls. RAM policy statement with action of atleast log:GetLogStoreLogs over resource acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName} is needed to grant a RAM user the permissions to call this operation.

Setup Instructions:

Configure access to AliCloud SLS API

Before using the API, you need to prepare your identity account and access key pair to effectively access the API.

1. We recommend that you use a Resource Access Management (RAM) user to call API operations. For more information, see create a RAM user and authorize the RAM user to access Simple Log Service.
2. Obtain the access key pair for the RAM user. For details see get Access Key pair.

Note the access key pair details for the next step.

Add ActionTrail Logstore

To enable the Alibaba Cloud ActionTrail connector for Microsoft Sentinel, click upon add ActionTrail Logstore, fill the form with the Alibaba Cloud environment configuration and click Connect.

• Data Connectors Grid (configure in portal)

Supported by: Microsoft Corporation

The Alibaba Cloud Networking data connector provides the capability to ingest Alibaba Cloud networking data into Microsoft Sentinel through the Simple Log Service (SLS) REST API. Refer to API documentation for more information. The connector provides the ability to get VPC Flow Logs, WAF Logs, and API Gateway Logs from Alibaba Cloud.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Alibaba Cloud SLS API access: Alibaba Cloud Simple Log Service access is required for the SLS API.

Setup Instructions:

Configure access to AliCloud SLS API

Before using the API, you need to prepare your identity account and access key pair to effectively access the API.

1. We recommend that you use a Resource Access Management (RAM) user to call API operations. For more information, see create a RAM user and authorize the RAM user to access Simple Log Service.
2. Obtain the access key pair for the RAM user. For details see get Access Key pair.

Note the access key pair details for the next step.

• Data Connectors Grid (configure in portal)

Supported by: Microsoft Corporation

The AliCloud data connector provides the capability to retrieve logs from cloud applications using the Cloud API and store events into Microsoft Sentinel through the REST API. The connector enables event retrieval to assess potential security risks, monitor collaboration, and diagnose and troubleshoot configuration issues.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. For more information, see Azure Functions.
• REST API Credentials/permissions: AliCloudAccessKeyId and AliCloudAccessKey are required for making API calls.

Setup Instructions:

NOTE: This connector uses Azure Functions to connect to the Azure Blob Storage API to pull logs into Microsoft Sentinel. This might result in additional costs for data ingestion and for storing data in Azure Blob Storage costs. Check the Azure Functions pricing page and Azure Blob Storage pricing page for details.

(Optional Step) Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. Follow these instructions to use Azure Key Vault with an Azure Function App.

NOTE: This data connector depends on a parser based on a Kusto Function to work as expected AliCloud which is deployed with the Microsoft Sentinel Solution.

STEP 1 - Configuration steps for the AliCloud API

Follow the instructions to obtain the credentials.

1. Obtain the AliCloudAccessKeyId and AliCloudAccessKey: log in the account, click on AccessKey Management then click View Secret.
2. Save credentials for using in the data connector.

STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function

IMPORTANT: Before deploying the AliCloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).

• Workspace ID: <variable value provided at install time>
• Primary Key: <variable value provided at install time>

Option 1 - Azure Resource Manager (ARM) Template

Use this method for automated deployment of the AliCloud data connector using an ARM Template.

1. Click the Deploy to Azure button below.

   aka.ms

2. Select the preferred Subscription, Resource Group and Location.

NOTE: Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group. 3. Enter the WorkspaceID, WorkspaceKey, AliCloudAccessKeyId, AliCloudAccessKey, AliCloudProjects and AppInsightsWorkspaceResourceID and deploy. 4. Mark the checkbox labeled I agree to the terms and conditions stated above. 5. Click Purchase to deploy.

Option 2 - Manual Deployment of Azure Functions

Use the following step-by-step instructions to deploy the AliCloud data connector manually with Azure Functions (Deployment via Visual Studio Code).

1. Deploy a Function App

NOTE: You will need to prepare VS code for Azure function development.

1. Download the Azure Function App file. Extract archive to your local development computer.

2. Start VS Code. Choose File in the main menu and select Open Folder.

3. Select the top level folder from extracted files.

4. Choose the Azure icon in the Activity bar, then in the Azure: Functions area, choose the Deploy to function app button. If you aren't already signed in, choose the Azure icon in the Activity bar, then in the Azure: Functions area, choose Sign in to Azure If you're already signed in, go to the next step.

5. Provide the following information at the prompts:

   a. Select folder: Choose a folder from your workspace or browse to one that contains your function app.

   b. Select Subscription: Choose the subscription to use.

   c. Select Create new Function App in Azure (Don't choose the Advanced option)

   d. Enter a globally unique name for the function app: Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. AliCloudXXXXX).

   e. Select a runtime: Choose Python 3.11.

   f. Select a location for new resources. For better performance and lower costs choose the same region where Microsoft Sentinel is located.

6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.

7. Go to Azure Portal for the Function App configuration.

8. Configure the Function App

9. In the Function App, select the Function App Name and select Configuration.

10. In the Application settings tab, select New application setting.

11. Add each of the following application settings individually, with their respective string values (case-sensitive): WorkspaceID WorkspaceKey AliCloudAccessKeyId AliCloudAccessKey AliCloudProjects AppInsightsWorkspaceResourceID

• Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: https://<CustomerId>.ods.opinsights.azure.us.

4. Once all application settings have been entered, click Save.

Supported by: Microsoft Corporation

Instructions to connect to AWS and stream your CloudTrail logs into Microsoft Sentinel are shown during the installation process. For more information, see the Microsoft Sentinel documentation.

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Supported by: Microsoft Corporation

This data connector enables the integration of AWS CloudFront logs with Microsoft Sentinel to support advanced threat detection, investigation, and security monitoring. By utilizing Amazon S3 for log storage and Amazon SQS for message queuing, the connector reliably ingests CloudFront access logs into Microsoft Sentinel

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Setup Instructions:

Ingesting AWS CloudFront logs in Microsoft Sentinel

List of Resources Required:

• Open ID Connect (OIDC) web identity provider
• IAM Role
• Amazon S3 Bucket
• Amazon SQS
• AWS CloudFront configuration

1. AWS CloudFormation Deployment To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from an S3 bucket to your Log Analytics Workspace.

For each template, create Stack in AWS:

1. Go to AWS CloudFormation Stacks.
2. Choose the ‘Specify template’ option, then ‘Upload a template file’ by clicking on ‘Choose file’ and selecting the appropriate CloudFormation template file provided below. click ‘Choose file’ and select the downloaded template.
3. Click 'Next' and 'Create stack'.

• Template 1: OpenID connect authentication deployment: <variable value provided at install time>
• Template 2: AWSCloudFront resources deployment: <variable value provided at install time>

2. Connect new collectors To enable AWS S3 for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect.

• Data Connectors Grid (configure in portal)

Supported by: Microsoft Corporation

The AWS Elastic Load Balancing (ELB) connector for Microsoft Sentinel allows you to ingest access logs and flow logs from AWS Application Load Balancers (ALB), Network Load Balancers (NLB), and Gateway Load Balancers (GLB) into Microsoft Sentinel. These logs provide detailed information about requests processed by your load balancers and VPC traffic flows, enabling security monitoring, threat detection, and traffic analysis.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• AWS IAM Role ARN and SQS Queue: An AWS IAM Role ARN with cross-account access and an SQS Queue URL configured for S3 event notifications are required. See AWS ELB connector documentation for setup instructions.

Setup Instructions:

1. AWS CloudFormation Deployment To configure access on AWS, use CloudFormation templates to set up the environment to send logs from ALB, NLB and GLB to your Log Analytics Workspace.

Deployment steps:

1. Go to the Cloud Formation Templates, download the JSON template files.
2. Go to AWS CloudFormation Stacks.
3. First deploy the OIDCWebIdProvider.json template (skip if you already have an OIDC provider for Microsoft Sentinel).
4. Then deploy the AWSS3ELB.json template with your parameters.
5. Note down the following values from the stack outputs:
   • IAMRoleArn
   • ALBSQSQueueURL
   • NLBSQSQueueURL
   • NLBFlowLogsSQSQueueURL
   • GLBFlowLogsSQSQueueURL

Post-deployment Configuration:

Once the CloudFormation stack is successfully deployed:

• Go to the Resources tab in the stack.
• Locate the created S3 bucket name.
• In the S3 bucket, manually create the following folders:
  • ALBLogs
  • NLBAccessLogs
  • NLBFlowLogs
  • GLBFlowLogs

Sending Logs:

After folder creation, configure your AWS services to send logs to the appropriate folders:

• ALB access logs -> ALBLogs/
• NLB access logs -> NLBAccessLogs/
• NLB flow logs -> NLBFlowLogs/
• GLB flow logs -> GLBFlowLogs/

These logs will be ingested into the corresponding tables in your Log Analytics Workspace.

Table Mapping:

• ALB access logs -> AWSALBAccessLogsData
• NLB access logs -> AWSNLBAccessLogsData
• NLB and GLB flow logs -> AWSELBFlowLogsData

Note: In the AWSELBFlowLogsData table, a column named LogType will indicate whether a row is from NLB flow logs or GLB flow logs.

2. Connect new collectors To enable the connector, click Add new collector, enter the required details, and click Connect.

• Data Connectors Grid (configure in portal)

Supported by: Microsoft Corporation

This data connector allows you to ingest AWS Network Firewall logs into Microsoft Sentinel for advanced threat detection and security monitoring. By leveraging Amazon S3 and Amazon SQS, the connector forwards network traffic logs, intrusion detection alerts, and firewall events to Microsoft Sentinel, enabling real-time analysis and correlation with other security data

Log Analytics table(s):

Data collection rule support: Workspace transform DCR

Setup Instructions:

Ingesting AWS NetworkFirewall logs in Microsoft Sentinel

List of Resources Required:

• Open ID Connect (OIDC) web identity provider
• IAM Role
• Amazon S3 Bucket
• Amazon SQS
• AWSNetworkFirewall configuration
• Follow this instructions for AWS NetworkFirewall Data connector configuration

1. AWS CloudFormation Deployment To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from an S3 bucket to your Log Analytics Workspace.

For each template, create Stack in AWS:

1. Go to AWS CloudFormation Stacks.
2. Choose the ‘Specify template’ option, then ‘