Share via

az sentinel data-connector

  • Reference

Note

This reference is part of the sentinel extension for the Azure CLI (version 2.37.0 or higher). The extension will automatically install the first time you run an az sentinel data-connector command. Learn more about extensions.

Manage data connector with sentinel.

Commands

Name Description Type Status
az sentinel data-connector connect

Connect a data connector.

 Extension Experimental
az sentinel data-connector create

Create the data connector.

 Extension Experimental
az sentinel data-connector delete

Delete the data connector.

 Extension Experimental
az sentinel data-connector disconnect

Disconnect a data connector.

 Extension Experimental
az sentinel data-connector list

Get all data connectors.

 Extension Experimental
az sentinel data-connector show

Get a data connector.

 Extension Experimental
az sentinel data-connector update

Update the data connector.

 Extension Experimental

az sentinel data-connector connect

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Connect a data connector.

az sentinel data-connector connect --data-connector-id
                                   --resource-group
                                   --workspace-name
                                   [--api-key]
                                   [--authorization-code]
                                   [--client-id]
                                   [--client-secret]
                                   [--endpoint]
                                   [--kind {APIKey, Basic, OAuth2}]
                                   [--output-stream]
                                   [--password]
                                   [--rule-immutable-id]
                                   [--user-name]

Required Parameters

--data-connector-id

Connector ID.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--workspace-name -w
Experimental

The name of the workspace.

Optional Parameters

--api-key

The API key of the audit server.

--authorization-code

The authorization code used in OAuth 2.0 code flow to issue a token.

--client-id

The client id of the OAuth 2.0 application.

--client-secret

The client secret of the OAuth 2.0 application.

--endpoint

Used in v2 logs connector. Represents the data collection ingestion endpoint in log analytics.

--kind

The authentication kind used to poll the data.

Accepted values: APIKey, Basic, OAuth2
--output-stream

Used in v2 logs connector. The stream we are sending the data to, this is the name of the streamDeclarations defined in the DCR.

--password

The user password in the audit log server.

--rule-immutable-id

Used in v2 logs connector. The data collection rule immutable id, the rule defines the transformation and data destination.

--user-name

The user name in the audit log server.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel data-connector create

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Create the data connector.

az sentinel data-connector create --data-connector-id
                                  --resource-group
                                  --workspace-name
                                  [--api-polling]
                                  [--aws-cloud-trail]
                                  [--aws-s3]
                                  [--azure-active-directory]
                                  [--azure-protection]
                                  [--azure-security-center]
                                  [--cloud-app-security]
                                  [--defender-protection]
                                  [--dynamics365]
                                  [--etag]
                                  [--generic-ui]
                                  [--intelligence-taxii]
                                  [--iot]
                                  [--microsoft-intelligence]
                                  [--microsoft-protection]
                                  [--office-atp]
                                  [--office-irm]
                                  [--office-power-bi]
                                  [--office365]
                                  [--office365-project]
                                  [--threat-intelligence]

Required Parameters

--data-connector-id --name -n

Connector ID.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--workspace-name -w
Experimental

The name of the workspace.

Optional Parameters

--api-polling

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--aws-cloud-trail

Amazon web services cloud trail. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--aws-s3

Amazon web services s3. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--azure-active-directory

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--azure-protection

Azure advanced threat protection. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--azure-security-center

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--cloud-app-security

Microsoft cloud app security. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--defender-protection

Microsoft defender advanced threat protection. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--dynamics365

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--etag

Etag of the azure resource.

--generic-ui

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--intelligence-taxii

Threat intelligence taxii. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--iot

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--microsoft-intelligence

Microsoft threat intelligence. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--microsoft-protection

Microsoft threat protection. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office-atp

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office-irm

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office-power-bi

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office365

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office365-project

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--threat-intelligence

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel data-connector delete

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Delete the data connector.

az sentinel data-connector delete [--data-connector-id]
                                  [--ids]
                                  [--resource-group]
                                  [--subscription]
                                  [--workspace-name]
                                  [--yes]

Optional Parameters

--data-connector-id --name -n

Connector ID.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--workspace-name -w
Experimental

The name of the workspace.

--yes -y

Do not prompt for confirmation.

Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel data-connector disconnect

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Disconnect a data connector.

az sentinel data-connector disconnect --data-connector-id
                                      --resource-group
                                      --workspace-name

Required Parameters

--data-connector-id

Connector ID.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--workspace-name -w
Experimental

The name of the workspace.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel data-connector list

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Get all data connectors.

az sentinel data-connector list --resource-group
                                --workspace-name

Required Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--workspace-name -w
Experimental

The name of the workspace.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel data-connector show

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Get a data connector.

az sentinel data-connector show [--data-connector-id]
                                [--ids]
                                [--resource-group]
                                [--subscription]
                                [--workspace-name]

Optional Parameters

--data-connector-id --name -n

Connector ID.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--workspace-name -w
Experimental

The name of the workspace.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel data-connector update

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Update the data connector.

az sentinel data-connector update [--add]
                                  [--api-polling]
                                  [--aws-cloud-trail]
                                  [--aws-s3]
                                  [--azure-active-directory]
                                  [--azure-protection]
                                  [--azure-security-center]
                                  [--cloud-app-security]
                                  [--data-connector-id]
                                  [--defender-protection]
                                  [--dynamics365]
                                  [--etag]
                                  [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--generic-ui]
                                  [--ids]
                                  [--intelligence-taxii]
                                  [--iot]
                                  [--microsoft-intelligence]
                                  [--microsoft-protection]
                                  [--office-atp]
                                  [--office-irm]
                                  [--office-power-bi]
                                  [--office365]
                                  [--office365-project]
                                  [--remove]
                                  [--resource-group]
                                  [--set]
                                  [--subscription]
                                  [--threat-intelligence]
                                  [--workspace-name]

Optional Parameters

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

--api-polling

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--aws-cloud-trail

Amazon web services cloud trail. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--aws-s3

Amazon web services s3. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--azure-active-directory

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--azure-protection

Azure advanced threat protection. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--azure-security-center

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--cloud-app-security

Microsoft cloud app security. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--data-connector-id --name -n

Connector ID.

--defender-protection

Microsoft defender advanced threat protection. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--dynamics365

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--etag

Etag of the azure resource.

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--generic-ui

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--intelligence-taxii

Threat intelligence taxii. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--iot

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--microsoft-intelligence

Microsoft threat intelligence. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--microsoft-protection

Microsoft threat protection. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office-atp

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office-irm

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office-power-bi

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office365

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--office365-project

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--threat-intelligence

Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--workspace-name -w
Experimental

The name of the workspace.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.