You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/sentinel-solutions-deploy.md
+29-28Lines changed: 29 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,65 +1,67 @@
1
1
---
2
-
title: Discover and deploy Microsoft Sentinel out-of-the-box solutions from Content hub
2
+
title: Discover and deploy Microsoft Sentinel out-of-the-box content from Content hub
3
3
description: Learn how to find and deploy Sentinel packaged solutions containing data connectors, analytics rules, hunting queries, workbooks, and other content.
4
4
author: austinmccollum
5
5
ms.topic: how-to
6
-
ms.date: 09/30/2022
6
+
ms.date: 01/09/2022
7
7
ms.author: austinmc
8
8
---
9
9
10
-
# Discover and deploy Microsoft Sentinel out-of-the-box solutions from Content hub (Public preview)
10
+
# Discover and manage Microsoft Sentinel out-of-the-box content (Public preview)
11
11
12
-
The Microsoft Sentinel Content hub provides access to out-of-the-box (built-in) solutions, which are packed with Sentinel content for end-to-end products by domain or industry.
12
+
The Microsoft Sentinel Content hub is your centralized location to discover and manage out-of-the-box (built-in) content. There you'll find packaged solutions for end-to-end products by domain or industry. You'll also have access to the vast number of standalone contributions hosted in our GitHub repository and feature blades.
13
13
14
-
- Discover solutions in the Content hub based on status, the content type, support, provider and category.
14
+
- Discover solutions and standalone content with a consistent set of filtering capabilities based on status, content type, support, provider and category.
15
15
16
-
- Install solutions in your workspace all at once or individually when you find ones that fit your organization's needs.
16
+
- Install content in your workspace all at once or individually.
17
17
18
-
- View solutions in list view and quickly see which ones have updates. Update them all at once.
18
+
- View content in list view and quickly see which solutions have updates. Update solutions all at once while standalone content updates automatically.
19
19
20
20
- Manage a solution to install its content types and get the latest changes.
21
21
22
+
- Configure standalone content to create new active items based on the most up-to-date template.
23
+
22
24
If you're a partner who wants to create your own solution, see the [Microsoft Sentinel Solutions Build Guide](https://aka.ms/sentinelsolutionsbuildguide) for solution authoring and publishing.
23
25
24
26
> [!IMPORTANT]
25
27
>
26
-
> Microsoft Sentinel solutions and the Microsoft Sentinel Content Hub are currently in **PREVIEW**, as are all individual solution packages. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
28
+
> Microsoft Sentinel solutions and standalone content in the Microsoft Sentinel Content Hub are currently in **PREVIEW**, as are all individual solution packages. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
27
29
28
30
## Prerequisites
29
31
30
-
In order to install, update or delete solutions in content hub, you need the **Template Spec Contributor** role at the resource group level. See [Azure RBAC built in roles](../role-based-access-control/built-in-roles.md#template-spec-contributor) for details on this role.
32
+
In order to install, update and delete standalone content or solutions in content hub, you need the **Template Spec Contributor** role at the resource group level. See [Azure RBAC built in roles](../role-based-access-control/built-in-roles.md#template-spec-contributor) for details on this role.
31
33
32
34
This is in addition to Sentinel specific roles. For more information about other roles and permissions supported for Microsoft Sentinel, see [Permissions in Microsoft Sentinel](roles.md).
33
35
34
36
35
-
## Discover solutions
37
+
## Discover content
36
38
37
-
The content hub offers the best way to find new solutions or manage the ones you already have installed.
39
+
The content hub offers the best way to find new content or manage the solutions you already have installed.
38
40
39
41
1. From the Microsoft Sentinel navigation menu, under **Content management**, select **Content hub (Preview)**.
40
42
41
-
1. The **Content hub** page displays a searchable grid or list of solutions.
43
+
1. The **Content hub** page displays a searchable grid or list of solutions and standalone content.
42
44
43
-
Filter the list displayed, either by selecting specific values from the filters, or entering any part of a product name or description in the **Search** field.
45
+
Filter the list displayed, either by selecting specific values from the filters, or entering any part of a content name or description in the **Search** field.
44
46
45
47
For more information, see [Categories for Microsoft Sentinel out-of-the-box content and solutions](sentinel-solutions.md#categories-for-microsoft-sentinel-out-of-the-box-content-and-solutions).
46
48
47
49
> [!TIP]
48
50
> If a solution that you've deployed has updates since you deployed it, the list view will have a blue up arrow in the status column, and will be included in the **Updates** blue up arrow count at the top of the page.
49
51
>
50
52
51
-
Each solution shows categories that apply to it, and the types of content included.
53
+
Each content item shows categories that apply to it, and solutions show the types of content included.
52
54
53
-
For example, in the following image, the **Cisco Umbrella** solution shows a category of**Security - Cloud Security**, and indicates it includes a data connector, analytics rules, hunting queries, playbooks, and more.
55
+
For example, in the following image, the **Cisco Umbrella** solution lists one of its categories as**Security - Cloud Security**, and indicates it includes a data connector, analytics rules, hunting queries, playbooks, and more.
54
56
55
57
:::image type="content" source="./media/sentinel-solutions-deploy/solutions-list.png" alt-text="Screenshot of the Microsoft Sentinel content hub.":::
56
58
57
59
58
-
## Install or update a solution
60
+
## Install or update content
59
61
60
-
Solutions can be installed and updated individually or in bulk. Here's the process for an individual solution.
62
+
Standalone content and solutions can be installed individually or all together in bulk. For more information on bulk operations, see [Bulk install and update content](#bulk-install-and-update-content) in the next section. Here's an example showing the install of an individual solution.
61
63
62
-
1. In the content hub, select a solution to view more information on the right. Then select **Install**, or **Update**. For example:
64
+
1. In the content hub, select a solution to view more information on the right. Then select **Install**, or **Update**.
63
65
64
66
1. On the solution details page, select **Create** or **Update** to start the solution wizard. On the **Basics** tab, enter the subscription, resource group, and workspace to deploy the solution. For example:
65
67
@@ -77,19 +79,18 @@ Solutions can be installed and updated individually or in bulk. Here's the proce
77
79
78
80
1. Each content type within the solution may require additional steps to configure. For more information, see [Enable content items in a solution](#enable-content-items-in-a-solution).
79
81
80
-
## Bulk install and update solutions
82
+
## Bulk install and update content
81
83
82
-
Content hub supports a list view in addition to the default card view. Multiple solutions can be selected with this view to install and update them all at once.
84
+
Content hub supports a list view in addition to the default card view. Multiple solutions and standalone content can be selected with this view to install and update them all at once. Standalone content is kept up-to-date automatically. Any active or
85
+
custom content created based on solutions or standalone content installed from content hub remains untouched.
83
86
84
87
1. To install and/or update items in bulk, change to the list view.
85
-
:::image type="content" source="media/sentinel-solutions-deploy/content-hub-list-view.png" alt-text="Screenshot of the list view icon button highlighted." lightbox="media/sentinel-solutions-deploy/content-hub-list-view.png":::
86
-
87
-
1. The list view is paginated, so choose a filter to ensure the solutions you want to bulk install and modify are in view. Select their checkboxes and click the **Install/Update** button.
88
-
89
-
1. The content hub interface will indicate *in progress* for installs and updates. Azure notifications will also indicate the action taken.
90
88
89
+
1. The list view is paginated, so choose a filter to ensure the content you want to bulk install are in view. Select their checkboxes and click the **Install/Update** button.
91
90
:::image type="content" source="media/sentinel-solutions-deploy/bulk-install-update.png" alt-text="Screenshot of solutions list view with multiple solutions selected and in progress for installation." lightbox="media/sentinel-solutions-deploy/bulk-install-update.png":::
92
91
92
+
1. The content hub interface will indicate *in progress* for installs and updates. Azure notifications will also indicate the action taken. If a solution or standalone content that was already installed or updated was selected, no action will be taken on that item and it won't interfere with the update and install of the other items.
93
+
93
94
1. Check each installed solution's **Manage** view. Content types within the solution may require additional steps to configure. For more information, see [Enable content items in a solution](#enable-content-items-in-a-solution).
94
95
95
96
## Enable content items in a solution
@@ -108,7 +109,7 @@ Centrally manage content items for installed solutions from the content hub.
108
109
1. Select a content item to get started.
109
110
110
111
### Management options for each content type
111
-
Below are some tips on how to interact with various content types when managing the solution.
112
+
Below are some tips on how to interact with various content types when managing a solution.
112
113
113
114
#### Data connector
114
115
1. Select **Open connector page**.
@@ -158,7 +159,7 @@ When a solution is installed, any parsers included are added as workspace functi
158
159
:::image type="content" source="media/sentinel-solutions-deploy/manage-solution-playbook.png" alt-text="Screenshot of playbook type content type in a solution." lightbox="media/sentinel-solutions-deploy/manage-solution-playbook.png":::
159
160
160
161
161
-
## Find the support model for your solution
162
+
## Find the support model for your content
162
163
163
164
Each solution explains its support model on the solution's details pane, in the **Support** box, where either **Microsoft** or a partner's name is listed. For example:
164
165
@@ -170,7 +171,7 @@ When contacting support, you may need other details about your solution, such as
170
171
171
172
## Next steps
172
173
173
-
In this document, you learned about Microsoft Sentinel solutions and how to find and deploy built-in content.
174
+
In this document, you learned how to find and deploy built-in solutions and standalone content for Microsoft Sentinel.
174
175
175
176
- Learn more about [Microsoft Sentinel solutions](sentinel-solutions.md).
176
177
- See the full Microsoft Sentinel solutions catalog in the [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps?filters=solution-templates&page=1&search=sentinel).
Copy file name to clipboardExpand all lines: articles/sentinel/sentinel-solutions.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ The Microsoft Sentinel Content Hub provides in-product discoverability, single-s
38
38
39
39
- In the **Content hub**, filter by [categories](#categories-for-microsoft-sentinel-out-of-the-box-content-and-solutions) and other parameters, or use the powerful text search, to find the content that works best for your organization's needs. The **Content hub** also indicates the [support model](#support-models-for-microsoft-sentinel-out-of-the-box-content-and-solutions) applied to each piece of content, as some content is maintained by Microsoft and others are maintained by partners or the community.
40
40
41
-
Manage [updates for out-of-the-box content](sentinel-solutions-deploy.md#install-or-update-a-solution) via the Microsoft Sentinel **Content hub**, and for custom content via the **Repositories** page.
41
+
Manage [updates for out-of-the-box content](sentinel-solutions-deploy.md#install-or-update-content) via the Microsoft Sentinel **Content hub**, and for custom content via the **Repositories** page.
42
42
43
43
- Customize out-of-the-box content for your own needs, or create custom content, including analytics rules, hunting queries, notebooks, workbooks, and more. Manage your custom content directly in your Microsoft Sentinel workspace, via the [Microsoft Sentinel API](/rest/api/securityinsights/), or in your own source control repository, via the Microsoft Sentinel [Repositories](ci-cd.md) page.
0 commit comments