Skip to content

Commit 8f9d88f

Browse files
authored
Update sentinel-content-centralize.md
1 parent 1afb940 commit 8f9d88f

File tree

1 file changed

+11
-11
lines changed

1 file changed

+11
-11
lines changed

articles/sentinel/sentinel-content-centralize.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ The Microsoft Sentinel content hub enables discovery and on-demand installation
2121

2222
## Content hub changes
2323

24-
To centralize all out-of-the-box content, we're planning to retire the gallery-only content templates. The legacy gallery content templates are no longer being updated consistently, and the content hub is where OOTB content stays up to date. The content hub also provides update workflows for solutions and automatic updates for standalone content.
24+
To centralize all OOTB content, we're planning to retire the gallery-only content templates. The legacy gallery content templates are no longer being updated consistently, and the content hub is where OOTB content stays up to date. The content hub also provides update workflows for solutions and automatic updates for standalone content.
2525

2626
To facilitate this transition, we're publishing a central tool to reinstate **IN USE** retired templates from corresponding content hub solutions.
2727

@@ -60,13 +60,13 @@ For the Microsoft Sentinel GitHub repo, OOTB content packaged in solutions in th
6060

6161
This change does not affect active or custom items (created from templates or otherwise). Specifically, this change doesn't affect the following items:
6262

63-
- Data connectors with `Status = Connected`.
63+
- Data connectors with **Status** = **Connected**.
6464
- Alert rules or detections (enabled or disabled) on the **Active rules** tab in the analytics gallery.
6565
- Saved workbooks on the **My workbooks** tab in the workbooks gallery.
66-
- Cloned content or `Content source = Custom` in the hunting gallery.
66+
- Cloned content or **Content source** = **Custom** in the hunting gallery.
6767
- Active playbooks (enabled or disabled) on the **Active playbooks** tab in the automation gallery.
6868

69-
This change also doesn't affect any OOTB content templates installed from content hub (identifiable as `Content source = Content hub`).
69+
This change also doesn't affect any OOTB content templates installed from the content hub (identifiable as **Content source** = **Content hub**).
7070

7171
### What's changing?
7272

@@ -78,11 +78,11 @@ The following table lists specific impacts to the content templates for each of
7878

7979
| Content type | Impact |
8080
| ------- | ------- |
81-
| [Data connectors](connect-data-sources.md) | Templates identifiable as `content source = "Gallery content"` and `Status = "Not connected"` will no longer appear in the data connectors gallery. |
82-
| [Analytics](detect-threats-built-in.md#view-built-in-detections) | Templates identifiable as `source name = "Gallery content"` will no longer appear in the analytics gallery. |
83-
| [Hunting](hunting.md#use-built-in-queries) | Templates with `Content source = "Gallery content"` will no longer appear in the hunting gallery. |
84-
| [Playbooks](use-playbook-templates.md#explore-playbook-templates) | Templates identifiable as `source name = "Gallery content"` will no longer appear in the automation playbooks gallery. |
85-
| [Workbooks](get-visibility.md#use-built-in-workbooks) | Templates with `Content source = "Gallery content"` will no longer appear in the workbooks gallery. |
81+
| [Data connectors](connect-data-sources.md) | Templates identifiable as **Content source** = **Gallery content** and **Status** = **Not connected** will no longer appear in the data connectors gallery. |
82+
| [Analytics](detect-threats-built-in.md#view-built-in-detections) | Templates identifiable as **Source name** = **Gallery content** will no longer appear in the analytics gallery. |
83+
| [Hunting](hunting.md#use-built-in-queries) | Templates with **Content source** = **Gallery content** will no longer appear in the hunting gallery. |
84+
| [Playbooks](use-playbook-templates.md#explore-playbook-templates) | Templates identifiable as **Source name** = **Gallery content** will no longer appear in the automation playbooks gallery. |
85+
| [Workbooks](get-visibility.md#use-built-in-workbooks) | Templates with **Content source** = **Gallery content** will no longer appear in the workbooks gallery. |
8686

8787
Here's an example of an analytics rule before and after the centralization changes and the tool has run:
8888

@@ -132,13 +132,13 @@ New REST API operations on the content hub will be available soon to enable OOTB
132132

133133
### How will the central tool identify my in-use OOTB content templates?
134134

135-
The tool builds a list of solutions based on two criteria: data connectors with `Status = "Connected"` and **IN USE** playbook templates. After the tool builds the proposed list of solutions, it will present the list for approval. If the list is approved, the tool installs all those solutions. Because the OOTB content is reinstated based on solutions, you might get more templates than you actually use.
135+
The tool builds a list of solutions based on two criteria: data connectors with **Status** = **Connected** and **IN USE** playbook templates. After the tool builds the proposed list of solutions, it will present the list for approval. If the list is approved, the tool installs all those solutions. Because the OOTB content is reinstated based on solutions, you might get more templates than you actually use.
136136

137137
This central tool is a best effort to get your **IN USE** OOTB content templates reinstated from the content hub. You can install omitted OOTB content directly from the content hub.
138138

139139
### What if I'm using APIs to connect data sources in my Microsoft Sentinel workspace?
140140

141-
Currently, if an API data connection matches the data connector data type, it will appear as `Status = "Connected"` in the data connectors gallery. After the centralization changes go live, the specific data connector needs to be installed from a respective solution to get the same behavior.
141+
Currently, if an API data connection matches the data connector data type, it will appear as **Status** = **Connected** in the data connectors gallery. After the centralization changes go live, the specific data connector needs to be installed from a respective solution to get the same behavior.
142142

143143
**Action needed:** Plan to update processes or tooling for your data connector deployments to install from content hub solutions before connecting with data ingestion APIs. The REST API operator for installing a solution will be coming in Q2 2023 with the OOTB content management APIs.
144144

0 commit comments

Comments
 (0)