Microsoft sentinel - Data connector shows disconnected after installing

Question

We recently activated Sentinel to give it a trial run. I set up a separate workspace for Sentinel and installed some data connectors. However, the WAF is still showing as disconnected even after installing and configuring it.

We've only got WAF, not Front Door, so I set up a diagnostic setting to send logs to the Sentinel workspace. However, it still shows as disconnected. I've even tried reinstalling it, but nothing seems to be working.

I manually performed some basic attacks to generate some logs, and while they're showing up in the workspace logs, they're not appearing in Sentinel. Could it be because the destination table should be set to Azure Diagnostics instead of resource-specific?

Answer 1

Correct, that Solution assumes the data is in AzureDiagnostics

https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Web%20Application%20Firewall%20(WAF)/Data%20Connectors/template_WAF.JSON Which you can see from the example

As data is coming in, you are working (but the connector will always be "disconnected"). Workbooks or Analytics wont be using your Tables, so you could amended them to match or revert to AzureDiagnostics