Microsoft Security | Microsoft Sentinel
A cloud-native SIEM solution that provides intelligent security analytics and threat detection across systems
Hello, please install the version in the Content Hub.
Azure Activity - data connector prerequisites
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 92%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAB%3C/text%3E%3C/svg%3E)
Aran Billen
956
Reputation points
Hi all,
When trying to enable the azure Acitvity connector in sentinal it says:
I am am owner of the subscription already?
Microsoft Security | Microsoft Sentinel
Answer accepted by question author
-
Clive Watson 7,946 Reputation points MVP Volunteer Moderator2024-04-08T15:05:35.1766667+00:00 -
Aran Billen 956 Reputation points
2024-04-08T17:33:24.09+00:00 Hi, i will give this a go and let you know, how come it needs to be done via the content hub?
-
Clive Watson 7,946 Reputation points MVP Volunteer Moderator
2024-04-08T21:56:26.0466667+00:00 Hello, The Data Connector blade and other ways of enabling content moved last year https://learn.microsoft.com/en-us/azure/sentinel/sentinel-content-centralize and https://learn.microsoft.com/en-us/azure/sentinel/sentinel-content-centralize#data-connector-page-change
-
Aran Billen 956 Reputation points
2024-04-09T10:19:36.5333333+00:00 Hi, I am having this warning issue?
-
Clive Watson 7,946 Reputation points MVP Volunteer Moderator
2024-04-09T16:39:17.8266667+00:00 That is just asking you to go to the connector page (you will end up back where you first started) but with the latest version of the connector
You should be asked to complete step 2 - "the blue launch button" below
-
Aran Billen 956 Reputation points
2024-04-10T07:46:24.8766667+00:00 I have already done the launcher wizard. How I have done this how do I view things for azure Activity? Should these appear in incidents?
-
Clive Watson 7,946 Reputation points MVP Volunteer Moderator
2024-04-10T13:01:22.1633333+00:00 You will only see Incidents if you enable the Rules that are aligned to that data, and they have triggered (which may take a while if there is little activity). Otherwise you can query the data using KQL in the Logs blade
You can enable Rules here (from the templates):
You can query here:
If you are new to KQL: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/get-started-queries just swap the examples to use: AzureActivity
-
Aran Billen 956 Reputation points
2024-04-11T10:50:41.44+00:00 Thank you!
Does each rule cost?
-
Aran Billen 956 Reputation points
2024-04-11T10:53:21.3866667+00:00 Does it cost to enable these rules?
-
Clive Watson 7,946 Reputation points MVP Volunteer Moderator
2024-04-11T12:25:01.1766667+00:00 Hello rules are free to deploy and use, as are KQL queries (within a rule and the logs blade).
Log ingestion can be billable (depending on source) and Playbooks are also billable.https://azure.microsoft.com/en-ca/pricing/details/microsoft-sentinel/
Microsoft Sentinel free data sourcesIn addition, following Microsoft 365 data sources are always free for all Microsoft Sentinel users as an ongoing Microsoft Sentinel benefit:
- Azure Activity Logs
- Office 365 Audit Logs (all SharePoint activity and Exchange admin activity)
- Alerts from Microsoft Defender for Cloud, Microsoft 365 Defender, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Endpoint and Microsoft Defender for Cloud Apps
- For more information on Microsoft Sentinel free data sources please see plan costs for Microsoft Sentinel.
Sign in to comment -