Describe Azure Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that allows you to collect, store, and analyze security data from a wide range of sources. These sources are referred to as data connectors, and Azure Sentinel supports a variety of connectors to enable you to ingest data from different sources.
Azure Sentinel data connectors fall into several categories:
- Microsoft connectors: These connectors enable you to collect data from Microsoft services such as Azure Activity Logs, Azure AD logs, Azure Firewall, and Microsoft 365.
- Azure partner connectors: Azure Sentinel has partnered with several security vendors to enable you to collect data from their solutions. These vendors include Check Point, Symantec, Palo Alto Networks, F5 Networks, and more.
- Industry-standard connectors: Azure Sentinel supports a range of industry-standard connectors such as Syslog, Common Event Format (CEF), and Security Assertion Markup Language (SAML).
- Custom connectors: Azure Sentinel also allows you to create custom connectors to collect data from any source that supports APIs.
When configuring data connections in Azure Sentinel, you will need to provide the necessary configuration details, such as the source address, protocol, port, and authentication details. You can also customize the data ingestion process by defining filters and transformations to ensure that only relevant data is collected.
Once you have configured data connections in Azure Sentinel, you can start ingesting security data from your sources. Azure Sentinel provides a range of tools and features to help you analyze and respond to security threats, including pre-built detection rules, machine learning models, and customizable dashboards and workbooks.
Here is a comprehensive list of all the data connections available in Azure Sentinel:
- Azure Active Directory (AAD) sign-in logs
- Azure Advanced Threat Protection (ATP)
- Azure Application Gateway
- Azure Container Registry
- Azure Container Instances
- Azure DNS
- Azure Firewall
- Azure Information Protection
- Azure Key Vault
- Azure Kubernetes Service (AKS)
- Azure Resource Manager (ARM) Activity logs
- Azure Security Center
- Azure Service Health
- Azure Storage
- Azure Virtual Machines (VMs)
- Azure Virtual Network (VNet) flow logs
- Azure Web Application Firewall (WAF)
- Cisco ASA
- Check Point Firewall
- CrowdStrike Falcon
- CyberArk Privileged Access Security Solution
- F5 BIG-IP
- IBM QRadar
- McAfee Endpoint Security
- Microsoft Cloud App Security
- Microsoft Defender Advanced Threat Protection (ATP)
- Microsoft Office 365
- Microsoft Threat Intelligence
- Microsoft 365 Defender
- Palo Alto Networks Firewall
- Proofpoint Email Protection
- Qualys Vulnerability Management
- SentinelOne Endpoint Protection
- Symantec Endpoint Protection
- Symantec Web Security Service (WSS)
- Tenable.sc
- Trend Micro Deep Security
- Zscaler Internet Access
In addition to these connectors, Azure Sentinel also supports industry-standard connectors such as Syslog, Common Event Format (CEF), and Security Assertion Markup Language (SAML), and allows you to create custom connectors to collect data from any source that supports APIs.
