Azure Sentinel Built-in Data Connector Does not Ingest Logs from Storage Container into Log Table

z88pu 6 Reputation points
2022-12-27T11:26:08.153+00:00

We were receiving logs from a particular log source (Cloudflare Firewall logs) into Sentinel using Sentinel's built-in data connectors. (The data connector was automatically deployed using ARM Template.)
Few days ago we made some configuration changes on the log source so that the logs would be pushed into Sentinel when matching certain criteria ( for example when they are associated with a particular host). But, after those config changes, the data connector stoped ingesting logs into the table. The logs are still being pushed into the storage container on Azure and are being consistently updated, but the are not being pushed into the log table. We even tried to reverse the changes on the source side so that logs would be exactly the same as before, but the problem still persists.
Trying to reconfigure the data connector by redeploying it using ARM Template also didn't help.

We would appreciate it if anybody could assist us on this urgent issue.

Azure Blob Storage
Azure Blob Storage
An Azure service that stores unstructured data in the cloud as blobs.
3,169 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,275 questions
{count} vote

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.