Configuring Data Connector And Producing Activity Data in Microsoft Sentinel

By establishing a connection with the service and receiving the events and logs, Microsoft Sentinel can get data from apps and services. Install the data connector for Azure Activity to send data to Microsoft Sentinel for this QuickStart.

Once you choose the Content hub from Microsoft Sentinel, for example, Locate and pick the Azure Activity Directory.

Microsoft Sentinel Content hub

Click Install/Update on the toolbar at the top of the page.

Azure active directory

Verify the Notification: Install Success.

Install successfully

Configure the data connector.

Choose Data connectors in Microsoft Sentinel.

Look for and choose the data connector for Azure Activity. (As an example, Microsoft Entra ID)

Data Connectors

Open Connector page should be selected from the connector's information pane.

Microsoft Entra id

To configure the connector, review the setup instructions.

Go to the Azure Policy Assignment Wizard and select Launch.

Instructions

Set the subscription and resource group that contains an activity to transmit to Microsoft Sentinel under the Basics tab's Scope setting. Choose the subscription, for instance, that houses your Microsoft Sentinel instance.

Click the tab for parameters.

Assign the workspace for Primary Log Analytics. This is where Microsoft Sentinel ought to be placed in the workspace.

Choose Review + Create and Press Start.

Produce activity information.

Enabling a rule that was part of the Azure Activity solution for Microsoft Sentinel will allow us to produce some activity data. You can also see how to manage content in the content center by following this step.

Choose Content Hub from Microsoft Sentinel.

Locate and choose the Microsoft Entra ID.

Choose Manage from the pane on the right.

Manage Content hub

Locate and choose the template for the rules.

Content name

Choose Configuration.

Configuration

After choosing a rule, create a rule.

Analytics rules

Make sure that the Status is enabled on the General tab. Don't change the remaining default settings.

General Analytics rule Wizard

Medium

Accept the other tabs' default settings.

Test Rule

Choose Create from the Review and Create tab.

Create tab

Once done, we can see the result.

Custom Content

See the data that Microsoft Sentinel has ingested.

Choose Data connectors in Microsoft Sentinel.

Look for and choose the data connector for Azure Activity. (As an example, Microsoft Entra ID)

Open Connector page should be selected from the connector's information pane.

Examine the data connector's current status. There ought to be a connection.

Choose Go to log analytics from the pane on the left above the chart.

Status connected

Logs

Summary

The present article explains configuring the data connector and producing activity data in Microsoft Sentinel. The subsequent article will cover the Set of Azure Sentinel Dashboards, Notebooks, and Queries.