Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,023 questions
DataConnector connectorUI attributes - sampleQueries
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 94%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESN%3C/text%3E%3C/svg%3E)
Sándor Tőkési
181
Reputation points
hey folks,
I was working on some data connectors and seemingly some of the old features are not working anymore.
I tried to use some fields which seem to be dated now. The most relevant would be the 'sampleQueries' attribute. I remember having these in the past. sampleQueries were available behind the 'Next step' button on the top. But I cannot see this button anymore, not even for connectors that definitely have sampleQueries in the code.
I'm curious, is this attribute still working? The following page still shows it as an option: https://learn.microsoft.com/en-us/azure/sentinel/data-connector-ui-definitions-reference and it is definitely there in some existing data connectors (even though it is not visible on the gui anymore).
But some other documentations do not mention this options anymore. (Based on some version change doc, it should be still valid: https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/change-log/dataconnectors
So, is this attribute still valid and if it is, how it can be accessed after connector deployment?
{count} votes
-
James Hamil 22,886 Reputation points Microsoft Employee2024-06-10T20:34:45.11+00:00 Hi @Sándor Tőkési ,the
sampleQueriesattribute is still a valid attribute for DataConnectorconnectorUIdefinitions. However, theNext stepsbutton that used to display the sample queries is no longer available in the Azure Sentinel UI.You can access the sample queries by navigating to the
Analyticstab in Azure Sentinel and selecting theSample queriesoption. From there, you can select the relevant data connector and view the sample queries associated with it.You can also include the sample queries in the
Instructionstab of theconnectorUIdefinition. This will display the sample queries along with the connector instructions when the connector is selected in the Azure Sentinel UI.Please let me know if I can help you further!
Best,
James
-
Sándor Tőkési 181 Reputation points
2024-06-11T14:53:19.3366667+00:00 thanks James
Do you have a link to a guide explaining where to find these Sample queries? I cannot locate it in my Sentinel on the Analytics tab.
Sign in to comment