Migrate to Innovate Summit:
Learn how migrating and modernizing to Azure can boost your business's performance, resilience, and security, enabling you to fully embrace AI.Register now
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Identifying and managing the lifecycle of deprecated solutions in Microsoft Sentinel
Article
The document explains how to manage the lifecycle of out-of-the-box solutions in Microsoft Sentinel that the solution author no longer supports. This document explains how to identify the solutions that are marked for deprecation and what actions to take on those solutions.
Reasons for solution deprecation
Here are some of the primary reasons why Solutions are sometimes deprecated in Microsoft Sentinel:
The software service provider stopped supporting the product or service that sends data to Microsoft Sentinel.
The author who originally published the solution is no longer actively supporting the solution or providing critical updates.
The product or service is acquired by another company necessitating ownership transfer to a different entity.
Identifying solutions that are marked as deprecated
Solutions that are marked as deprecated can be identified using the DEPRECATED tag against the solution name in Microsoft Sentinel content hub. Solutions that are marked as deprecated are shown first in the content hub, followed by other solutions in alphabetical order.
Actions to take on solutions that are marked as deprecated
Navigate to Microsoft Sentinel content hub and look for solutions that are flagged as DEPRECATED and the status shows Installed.
Select the solution matching this criterion. If an alternate solution is available, Navigate to solution button is visible at the bottom of the solutions details view. If the Navigate to solution button isn't available, this means that there are no alternate solutions available. In this case, proceed with uninstalling the deprecated solution.
Select on Navigate to solution button to go to the alternate solution and then select the Install button to install the new solution.
After you install the new solution, you can proceed to uninstall the deprecated solution. Disconnect the data connectors and remove the other content items that were part of the deprecated solution. For more information, see Delete installed Microsoft Sentinel out-of-the-box content and solutions.
Before configuring the alternate solution, make sure to fully remove all the content items in the deprecated solution to ensure that data isn't duplicated.
Learn how to manage your content lifecycle using solutions to import, store, and classify business-critical data so you can keep what you need and delete what you don't.