Monitor Data Connector Status changes - Sentinel
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(272, 97%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMC%3C/text%3E%3C/svg%3E)
Miguel Calderón
45
Puntos de reputación
Dear Team.
I´m trying to find the way to monitor the Data Connector status using KQL, and also when Data Connector is Installed or Deleted, please let me know if you have any ideas.
btw, i just tried with sentinel health table, but it only help with certains amount of connectors
BR
Miguel
{count} votos
-
Miguel Calderón 45 Puntos de reputación
2024-01-03T20:20:38.2833333+00:00 Hey Team, i tryed with the following OperationNameValue
AzureActivity | extend Resource = tostring(Properties_d.resource) | where OperationNameValue in ("MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS/DELETE", "MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS/WRITE") | where ActivityStatusValue contains "Success"and then i can get the resource in this format.
Test-loganalytics/microsoft.securityinsights/1d9b4a67-ceef-4873-b952-xxxxxxxxx Test-loganalytics/microsoft.securityinsights/8efda110-09d9-443c-8ed8-xxxxxxxx Test-loganalytics/microsoft.securityinsights/threatintelligence Test-loganalytics/microsoft.securityinsights/windowsfirewallSometimes i get the Connector name like "threatintelligence" as a result but also i could have "d9b4a67-ceef-4873-b952-xxxxxxxxx" , instead of Entra ID.
is there a table where i can match this IDs with a name?
Inicie sesión para escribir un comentario
Inicie sesión para responder