Skip to content

Commit 43b0a8c

Browse files
edits from review
1 parent 3b57450 commit 43b0a8c

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

articles/sentinel/siem-migration.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ You need the following from the source SIEM:
3333
You need the following on the target, Microsoft Sentinel:
3434

3535
- The SIEM migration experience deploys analytics rules. This capability requires the **Microsoft Sentinel Contributor** role. For more information, see [Permissions in Microsoft Sentinel](roles.md).
36-
- Ingest security data previously used in your source SIEM into Microsoft Sentinel by enabling an out-of-the-box (OOTB) data connector.
37-
- If the data connector isn't installed yet, find the relevant solution in **Content hub**.
36+
- Ingest security data previously used in your source SIEM into Microsoft Sentinel. Install and enable out-of-the-box (OOTB) data connectors to match your security monitoring estate from your source SIEM. [MULTIPLE]
37+
- If the data connectors aren't installed yet, find the relevant solutions in **Content hub**.
3838
- If no data connector exists, create a custom ingestion pipeline.<br>For more information, see [Discover and manage Microsoft Sentinel out-of-the-box content](sentinel-solutions-deploy.md) or [Custom data ingestion and transformation](data-transformation.md).
3939

4040
## Translate Splunk detection rules
@@ -51,9 +51,9 @@ Current capabilities:
5151
Here are some of the priorities that are important to us as we continue to develop the translation technology:
5252

5353
- Splunk Common Information Model (CIM) to Microsoft Sentinel's Advanced Security Information Model (ASIM) translation support
54-
- Translation of complex correlation logic that queries and correlates events across multiple data sources
5554
- Support for Splunk macros
56-
- Support for Splunk lookups
55+
- Support for Splunk lookups
56+
- Translation of complex correlation logic that queries and correlates events across multiple data sources
5757

5858
## Start the SIEM migration experience
5959

@@ -113,7 +113,7 @@ Here are some of the priorities that are important to us as we continue to devel
113113

114114
The following resources are deployed:
115115
- For all OOTB matches, the corresponding solutions with the matched analytics rule are installed, and the matched rules are deployed as active analytics rules.
116-
- All custom rules translated to Sentinel analytics rules are deployed as active analytics rules.
116+
- All custom rules translated to Sentinel analytics rules are deployed as active analytics rules in the disabled state.
117117

118118
1. Before exiting the SIEM Migration experience, **Download Migration Summary** to keep a summary of the Analytics deployment.
119119

0 commit comments

Comments
 (0)