You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#Customer intent: As a security operator, set up data connectors in one place so I can monitor and protect my environment.
10
10
---
@@ -36,6 +36,8 @@ Microsoft Sentinel comes with many data connectors for Microsoft products such a
36
36
37
37
## Enable Microsoft Sentinel <aname="enable"></a>
38
38
39
+
To get started, add Microsoft Sentinel to an existing workspace or create a new one.
40
+
39
41
1. Sign in to the [Azure portal](https://portal.azure.com/).
40
42
41
43
1. Search for and select **Microsoft Sentinel**.
@@ -44,21 +46,18 @@ Microsoft Sentinel comes with many data connectors for Microsoft products such a
44
46
45
47
1. Select **Add**.
46
48
47
-
1. Select the workspace you want to use or create a new one. You can run Microsoft Sentinel on more than one workspace, but the data is isolated to a single workspace. Note that default workspaces created by Microsoft Defender for Cloud are not shown in the list. You can't install Microsoft Sentinel on these workspaces.
49
+
1. Select the workspace you want to use or create a new one. You can run Microsoft Sentinel on more than one workspace, but the data is isolated to a single workspace.
48
50
49
51
:::image type="content" source="media/quickstart-onboard/choose-workspace.png" alt-text="Screenshot of choosing a workspace while enabling Microsoft Sentinel.":::
50
-
51
-
>[!IMPORTANT]
52
-
>
53
-
> - Once deployed on a workspace, Microsoft Sentinel **does not currently support** the moving of that workspace to other resource groups or subscriptions.
54
-
>
55
-
> If you have already moved the workspace, disable all active rules under **Analytics** and re-enable them after five minutes. This should be effective in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.
52
+
53
+
- The default workspaces created by Microsoft Defender for Cloud are not shown in the list. You can't install Microsoft Sentinel on these workspaces.
54
+
- Once deployed on a workspace, Microsoft Sentinel **doesn't currently support** moving that workspace to another resource group or subscription.
56
55
57
56
1. Select **Add Microsoft Sentinel**.
58
57
59
58
## Install a solution from the content hub
60
59
61
-
The content hub in Microsoft Sentinel is the centralized location to discover and manage out-of-the-box (built-in) content including data connectors.
60
+
The content hub in Microsoft Sentinel is the centralized location to discover and manage out-of-the-box (built-in) content including data connectors. For this quickstart, install the solution for Azure Activity.
62
61
63
62
1. In Microsoft Sentinel, select **Content hub**.
64
63
@@ -70,7 +69,7 @@ The content hub in Microsoft Sentinel is the centralized location to discover an
70
69
71
70
## Set up the data connector
72
71
73
-
Microsoft Sentinel ingests data from services and apps by connecting to the service and forwarding the events and logs to Microsoft Sentinel. For this quickstart, you'll install the data connector to forward data for Azure Activity to Microsoft Sentinel.
72
+
Microsoft Sentinel ingests data from services and apps by connecting to the service and forwarding the events and logs to Microsoft Sentinel. For this quickstart, install the data connector to forward data for Azure Activity to Microsoft Sentinel.
74
73
75
74
1. In the Azure portal, search for and select **Microsoft Sentinel**.
76
75
1. In Microsoft Sentinel, select **Data connectors**.
0 commit comments