Connector

As explained in Azure Security

A data connector is an integration component that collects data from a source and makes it available to a monitoring or analytics system.

A data connector integrates a selected data source with Microsoft Sentinel so its alerts or logs can be ingested for threat detection and investigation. Connectors offer a straightforward collection path across Microsoft and third-party services, while source selection should follow defined investigation use cases and required visibility. section 8.3.1 section 8.3.2

Collect beyond Azure IaaS and PaaS when identities, collaboration tools, endpoints, network controls, SaaS applications, or threat intelligence can provide evidence needed to connect an incident’s signals. Sentinel provides more than 100 out-of-the-box connectors for commonly used sources; check the Data Connectors list before considering a custom integration. section 8.3.1 section 8.3.2

Configure a connector after choosing a relevant source:

• Open Microsoft Sentinel and select Data Connectors. section 8.3.2
• Find the source’s connector, open its connector page, and follow its collection instructions. section 8.3.3
• Select the appropriate subscription where required, enable collection, and enable incident creation when alerts should create Sentinel incidents. section 8.3.3
• Account for ingestion and Log Analytics workspace storage charges; some data types, including Defender for Cloud security alerts, are free to ingest. section 8.3.3

Defender for Cloud alert ingestion

Configure the Microsoft Defender for Cloud connector in Sentinel, select the subscription where Defender for Cloud is enabled, turn on its status, and enable incident creation. Bidirectional alert synchronization is enabled by default, so closing a Sentinel incident also closes its associated Defender for Cloud alerts. section 8.3.3

For a service or application without a suitable built-in connector, the Codeless Connector Platform can expose its data through a public REST API endpoint for Sentinel ingestion. Content hub can also deploy connectors together with analytics, workbooks, and automations for an end-to-end scenario; it is positioned as the direction for connector deployment while remaining in public preview. section 8.3.2 section 8.3.4

Figure 8.2 The Microsoft Defender for Cloud data connector in Microsoft Sentinel

Use the connector view to recognize the Sentinel portal location for a Microsoft Defender for Cloud integration and its configuration workflow. section 8.3.3

How Azure Security covers it

How deep it goes

Walks through portal-based Defender for Cloud configuration, incident creation, synchronization, and cost notes; defers custom connector construction to CCP resources.

Examples

Uses Microsoft Defender for Cloud alert ingestion and bidirectional incident synchronization with Sentinel.

What it assumes

Assumes defined SIEM use cases, selected data sources, and read/write permissions to the Log Analytics workspace.

What you can do after

Operate/configure a Sentinel connector to ingest Defender for Cloud alerts and create incidents.

How it connects

Connects Microsoft Sentinel with Content hub, analytics rules, playbooks, Log Analytics workspaces, REST APIs, and Microsoft Defender for Cloud.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Kafka Streams in Action, Second EditionA connector is a Kafka Connect component that coordinates tasks for moving data between Kafka and an external system.
• 

  liveBookmanning.com
  Kafka for ArchitectsA connector is a configured Kafka Connect instance that defines a particular data pipeline between Kafka and an external system.
• 

  liveBookmanning.com
  Apache Kafka in ActionA Kafka Connect connector is a component that transfers data between Kafka and an external system according to a configured connection definition.
• 

  liveBookmanning.com
  AI for Everyday ITA connector is a software integration component that exposes access to an external service or data source for an application or workflow.
• 

  liveBookmanning.com
  Quarkus in ActionA connector is a MicroProfile Reactive Messaging service-provider interface implementation that bridges a messaging channel to an external messaging provider.
• 

  liveBookmanning.com
  Data Analysis with LLMsAn integration component that enables a language model to access external data sources such as web search services or databases.

Compare how 7 books explain connector →

Related concepts

• source connectorincludes · A source connector is a Kafka Connect connector that reads data from an external source system and publishes records to Kafka.
• Kafka Connectused by · Kafka Connect is a framework for reliably transferring data between Apache Kafka and external systems through configurable source and sink connectors.
• sink connectorincludes · A sink connector is a Kafka Connect connector that reads records from Kafka and exports them to an external destination system.
• data sourceuses · A data source is an origin, system, repository, or process from which data is obtained for use or processing.
• Azure Logic Appsused by · Azure Logic Apps is Microsoft's managed cloud service for designing and running automated workflows that integrate applications, services, data, and events.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.