Microsoft Sentinel - Data Connector is showing as disconnected but is sending logs.

Question

Hello everyone.

I have a client that has both the 'Common Event Format via Legacy Agent' and 'Common Event Format via AMA' Data Connectors in their Microsoft Sentinel environment. Both are sending logs to the 'CommonSecurityLog' table, but oddly the 'Common Event Format via AMA' Data Connector is reading as disconnected. It seems odd to me that the Data Connector is reading as disconnected but still sending logs into the table.

Only thing I am seeing is that the CEF via AMA Data Connector does not have a Data Collection Rule associated with it. Could that have anything to do with it?

Does anyone have any insight on this that can help? Any insight is appreciated.

Thanks! :)

Answer 1

@Matthew Agosta Apologies for the delayed response in reviewing this post, Yes it is possible that the disconnected status of the 'Common Event Format via AMA' Data Connector is due to the lack of a Data Collection Rule associated with it. A Data Collection Rule is used to specify which logs should be collected by a Data Connector. Without a Data Collection Rule, the Data Connector may not be able to collect any logs, which could result in a disconnected status.

Review this documentation where it states DCR is required to have logs ingested in Sentinel - https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama?tabs=portal#:~:text=TLS%20%E2%80%93%20syslog%2Dng-,Configure%20the%20data%20connector,-The%20setup%20process

Feel free to reach out if you have any more questions. If you've already found a solution, please consider sharing it here to benefit other community members.