Skip to content

Commit 1006358

Browse files
author
cabailey
committed
formatting
1 parent c3b83c0 commit 1006358

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

articles/sentinel/connect-azure-information-protection.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,17 @@ Use the following instructions if you haven't configured a Log Analytics workspa
5353

5454
1. In Azure Sentinel, select **Data connectors**, and then **Azure Information Protection**.
5555

56-
2. On the **Azure Information Protection** blade, you see the **STATUS** displays **Not connected**. Select **Open connector page**.
56+
2. On the **Azure Information Protection** blade, select **Open connector page**.
5757

5858
3. On the next blade, in the **Configuration** section, select **Azure Information Protection** to go to **Azure Information Protection analytics**.
5959

6060
4. From the list of available workspaces, select the workspace that you're currently using for Azure Sentinel. If you select a different workspace, the reporting data from Azure Information Protection won't be available to Azure Sentinel.
6161

6262
5. When you have selected a workspace, select **OK** and the connector **STATUS** should now change to **Connected**.
6363

64-
6. The reporting data from Azure Information Protection is stored in the **InformationProtectionLogs_CL** table within the selected workspace. To use the relevant schema in Azure Monitor for this reporting data, search for **InformationProtectionEvents**. For information about these event functions, see the [Friendly schema reference for event functions](https://docs.microsoft.com/azure/information-protection/reports-aip#friendly-schema-reference-for-event-functions) section from the Azure Information Protection documentation.
64+
6. The reporting data from Azure Information Protection is stored in the **InformationProtectionLogs_CL** table within the selected workspace.
65+
66+
To use the relevant schema in Azure Monitor for this reporting data, search for **InformationProtectionEvents**. For information about these event functions, see the [Friendly schema reference for event functions](https://docs.microsoft.com/azure/information-protection/reports-aip#friendly-schema-reference-for-event-functions) section from the Azure Information Protection documentation.
6567

6668
## Next steps
6769
In this document, you learned how to connect Azure Information Protection to Azure Sentinel. To learn more about Azure Sentinel, see the following articles:

0 commit comments

Comments
 (0)