DataConnector connectorUI attributes - sampleQueries

Question

hey folks,

I was working on some data connectors and seemingly some of the old features are not working anymore.

I tried to use some fields which seem to be dated now. The most relevant would be the 'sampleQueries' attribute. I remember having these in the past. sampleQueries were available behind the 'Next step' button on the top. But I cannot see this button anymore, not even for connectors that definitely have sampleQueries in the code.

I'm curious, is this attribute still working? The following page still shows it as an option: https://learn.microsoft.com/en-us/azure/sentinel/data-connector-ui-definitions-reference and it is definitely there in some existing data connectors (even though it is not visible on the gui anymore).

But some other documentations do not mention this options anymore. (Based on some version change doc, it should be still valid: https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/change-log/dataconnectors

So, is this attribute still valid and if it is, how it can be accessed after connector deployment?

Answer 1

Hi @Sándor Tőkési ,the sampleQueries attribute is still a valid attribute for DataConnector connectorUI definitions. However, the Next steps button that used to display the sample queries is no longer available in the Azure Sentinel UI.

You can access the sample queries by navigating to the Analytics tab in Azure Sentinel and selecting the Sample queries option. From there, you can select the relevant data connector and view the sample queries associated with it.

You can also include the sample queries in the Instructions tab of the connectorUI definition. This will display the sample queries along with the connector instructions when the connector is selected in the Azure Sentinel UI.

Please let me know if I can help you further!

Best,

James