Skip to content

Commit 5f0bb8d

Browse files
committed
Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into otherFixes
2 parents 1d17ed0 + aef129a commit 5f0bb8d

File tree

6 files changed

+41
-40
lines changed

6 files changed

+41
-40
lines changed
28.5 KB
Loading
-41.4 KB
Loading
-12.1 KB
Loading

articles/sentinel/sentinel-solutions-deploy.md

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,67 @@
11
---
2-
title: Discover and deploy Microsoft Sentinel out-of-the-box solutions from Content hub
2+
title: Discover and deploy Microsoft Sentinel out-of-the-box content from Content hub
33
description: Learn how to find and deploy Sentinel packaged solutions containing data connectors, analytics rules, hunting queries, workbooks, and other content.
44
author: austinmccollum
55
ms.topic: how-to
6-
ms.date: 09/30/2022
6+
ms.date: 01/09/2022
77
ms.author: austinmc
88
---
99

10-
# Discover and deploy Microsoft Sentinel out-of-the-box solutions from Content hub (Public preview)
10+
# Discover and manage Microsoft Sentinel out-of-the-box content (Public preview)
1111

12-
The Microsoft Sentinel Content hub provides access to out-of-the-box (built-in) solutions, which are packed with Sentinel content for end-to-end products by domain or industry.
12+
The Microsoft Sentinel Content hub is your centralized location to discover and manage out-of-the-box (built-in) content. There you'll find packaged solutions for end-to-end products by domain or industry. You'll also have access to the vast number of standalone contributions hosted in our GitHub repository and feature blades.
1313

14-
- Discover solutions in the Content hub based on status, the content type, support, provider and category.
14+
- Discover solutions and standalone content with a consistent set of filtering capabilities based on status, content type, support, provider and category.
1515

16-
- Install solutions in your workspace all at once or individually when you find ones that fit your organization's needs.
16+
- Install content in your workspace all at once or individually.
1717

18-
- View solutions in list view and quickly see which ones have updates. Update them all at once.
18+
- View content in list view and quickly see which solutions have updates. Update solutions all at once while standalone content updates automatically.
1919

2020
- Manage a solution to install its content types and get the latest changes.
2121

22+
- Configure standalone content to create new active items based on the most up-to-date template.
23+
2224
If you're a partner who wants to create your own solution, see the [Microsoft Sentinel Solutions Build Guide](https://aka.ms/sentinelsolutionsbuildguide) for solution authoring and publishing.
2325

2426
> [!IMPORTANT]
2527
>
26-
> Microsoft Sentinel solutions and the Microsoft Sentinel Content Hub are currently in **PREVIEW**, as are all individual solution packages. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
28+
> Microsoft Sentinel solutions and standalone content in the Microsoft Sentinel Content Hub are currently in **PREVIEW**, as are all individual solution packages. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
2729
2830
## Prerequisites
2931

30-
In order to install, update or delete solutions in content hub, you need the **Template Spec Contributor** role at the resource group level. See [Azure RBAC built in roles](../role-based-access-control/built-in-roles.md#template-spec-contributor) for details on this role.
32+
In order to install, update and delete standalone content or solutions in content hub, you need the **Template Spec Contributor** role at the resource group level. See [Azure RBAC built in roles](../role-based-access-control/built-in-roles.md#template-spec-contributor) for details on this role.
3133

3234
This is in addition to Sentinel specific roles. For more information about other roles and permissions supported for Microsoft Sentinel, see [Permissions in Microsoft Sentinel](roles.md).
3335

3436

35-
## Discover solutions
37+
## Discover content
3638

37-
The content hub offers the best way to find new solutions or manage the ones you already have installed.
39+
The content hub offers the best way to find new content or manage the solutions you already have installed.
3840

3941
1. From the Microsoft Sentinel navigation menu, under **Content management**, select **Content hub (Preview)**.
4042

41-
1. The **Content hub** page displays a searchable grid or list of solutions.
43+
1. The **Content hub** page displays a searchable grid or list of solutions and standalone content.
4244

43-
Filter the list displayed, either by selecting specific values from the filters, or entering any part of a product name or description in the **Search** field.
45+
Filter the list displayed, either by selecting specific values from the filters, or entering any part of a content name or description in the **Search** field.
4446

4547
For more information, see [Categories for Microsoft Sentinel out-of-the-box content and solutions](sentinel-solutions.md#categories-for-microsoft-sentinel-out-of-the-box-content-and-solutions).
4648

4749
> [!TIP]
4850
> If a solution that you've deployed has updates since you deployed it, the list view will have a blue up arrow in the status column, and will be included in the **Updates** blue up arrow count at the top of the page.
4951
>
5052
51-
Each solution shows categories that apply to it, and the types of content included.
53+
Each content item shows categories that apply to it, and solutions show the types of content included.
5254

53-
For example, in the following image, the **Cisco Umbrella** solution shows a category of **Security - Cloud Security**, and indicates it includes a data connector, analytics rules, hunting queries, playbooks, and more.
55+
For example, in the following image, the **Cisco Umbrella** solution lists one of its categories as **Security - Cloud Security**, and indicates it includes a data connector, analytics rules, hunting queries, playbooks, and more.
5456

5557
:::image type="content" source="./media/sentinel-solutions-deploy/solutions-list.png" alt-text="Screenshot of the Microsoft Sentinel content hub.":::
5658

5759

58-
## Install or update a solution
60+
## Install or update content
5961

60-
Solutions can be installed and updated individually or in bulk. Here's the process for an individual solution.
62+
Standalone content and solutions can be installed individually or all together in bulk. For more information on bulk operations, see [Bulk install and update content](#bulk-install-and-update-content) in the next section. Here's an example showing the install of an individual solution.
6163

62-
1. In the content hub, select a solution to view more information on the right. Then select **Install**, or **Update**. For example:
64+
1. In the content hub, select a solution to view more information on the right. Then select **Install**, or **Update**.
6365

6466
1. On the solution details page, select **Create** or **Update** to start the solution wizard. On the **Basics** tab, enter the subscription, resource group, and workspace to deploy the solution. For example:
6567

@@ -77,19 +79,18 @@ Solutions can be installed and updated individually or in bulk. Here's the proce
7779

7880
1. Each content type within the solution may require additional steps to configure. For more information, see [Enable content items in a solution](#enable-content-items-in-a-solution).
7981

80-
## Bulk install and update solutions
82+
## Bulk install and update content
8183

82-
Content hub supports a list view in addition to the default card view. Multiple solutions can be selected with this view to install and update them all at once.
84+
Content hub supports a list view in addition to the default card view. Multiple solutions and standalone content can be selected with this view to install and update them all at once. Standalone content is kept up-to-date automatically. Any active or
85+
custom content created based on solutions or standalone content installed from content hub remains untouched.
8386

8487
1. To install and/or update items in bulk, change to the list view.
85-
:::image type="content" source="media/sentinel-solutions-deploy/content-hub-list-view.png" alt-text="Screenshot of the list view icon button highlighted." lightbox="media/sentinel-solutions-deploy/content-hub-list-view.png":::
86-
87-
1. The list view is paginated, so choose a filter to ensure the solutions you want to bulk install and modify are in view. Select their checkboxes and click the **Install/Update** button.
88-
89-
1. The content hub interface will indicate *in progress* for installs and updates. Azure notifications will also indicate the action taken.
9088

89+
1. The list view is paginated, so choose a filter to ensure the content you want to bulk install are in view. Select their checkboxes and click the **Install/Update** button.
9190
:::image type="content" source="media/sentinel-solutions-deploy/bulk-install-update.png" alt-text="Screenshot of solutions list view with multiple solutions selected and in progress for installation." lightbox="media/sentinel-solutions-deploy/bulk-install-update.png":::
9291

92+
1. The content hub interface will indicate *in progress* for installs and updates. Azure notifications will also indicate the action taken. If a solution or standalone content that was already installed or updated was selected, no action will be taken on that item and it won't interfere with the update and install of the other items.
93+
9394
1. Check each installed solution's **Manage** view. Content types within the solution may require additional steps to configure. For more information, see [Enable content items in a solution](#enable-content-items-in-a-solution).
9495

9596
## Enable content items in a solution
@@ -108,7 +109,7 @@ Centrally manage content items for installed solutions from the content hub.
108109
1. Select a content item to get started.
109110

110111
### Management options for each content type
111-
Below are some tips on how to interact with various content types when managing the solution.
112+
Below are some tips on how to interact with various content types when managing a solution.
112113

113114
#### Data connector
114115
1. Select **Open connector page**.
@@ -158,7 +159,7 @@ When a solution is installed, any parsers included are added as workspace functi
158159
:::image type="content" source="media/sentinel-solutions-deploy/manage-solution-playbook.png" alt-text="Screenshot of playbook type content type in a solution." lightbox="media/sentinel-solutions-deploy/manage-solution-playbook.png":::
159160

160161

161-
## Find the support model for your solution
162+
## Find the support model for your content
162163

163164
Each solution explains its support model on the solution's details pane, in the **Support** box, where either **Microsoft** or a partner's name is listed. For example:
164165

@@ -170,7 +171,7 @@ When contacting support, you may need other details about your solution, such as
170171

171172
## Next steps
172173

173-
In this document, you learned about Microsoft Sentinel solutions and how to find and deploy built-in content.
174+
In this document, you learned how to find and deploy built-in solutions and standalone content for Microsoft Sentinel.
174175

175176
- Learn more about [Microsoft Sentinel solutions](sentinel-solutions.md).
176177
- See the full Microsoft Sentinel solutions catalog in the [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps?filters=solution-templates&page=1&search=sentinel).

articles/sentinel/sentinel-solutions.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ The Microsoft Sentinel Content Hub provides in-product discoverability, single-s
3838

3939
- In the **Content hub**, filter by [categories](#categories-for-microsoft-sentinel-out-of-the-box-content-and-solutions) and other parameters, or use the powerful text search, to find the content that works best for your organization's needs. The **Content hub** also indicates the [support model](#support-models-for-microsoft-sentinel-out-of-the-box-content-and-solutions) applied to each piece of content, as some content is maintained by Microsoft and others are maintained by partners or the community.
4040

41-
Manage [updates for out-of-the-box content](sentinel-solutions-deploy.md#install-or-update-a-solution) via the Microsoft Sentinel **Content hub**, and for custom content via the **Repositories** page.
41+
Manage [updates for out-of-the-box content](sentinel-solutions-deploy.md#install-or-update-content) via the Microsoft Sentinel **Content hub**, and for custom content via the **Repositories** page.
4242

4343
- Customize out-of-the-box content for your own needs, or create custom content, including analytics rules, hunting queries, notebooks, workbooks, and more. Manage your custom content directly in your Microsoft Sentinel workspace, via the [Microsoft Sentinel API](/rest/api/securityinsights/), or in your own source control repository, via the Microsoft Sentinel [Repositories](ci-cd.md) page.
4444

0 commit comments

Comments
 (0)