Skip to content

Commit ac9f01a

Browse files
author
Anil Godavarthy
committed
Fixed feedback from Catherine to convert H3 sections to table and add description under H2. Also made chanegs to TOC to consolidate articles related to ISV under a single section
1 parent ff29127 commit ac9f01a

File tree

2 files changed

+44
-83
lines changed

2 files changed

+44
-83
lines changed

articles/sentinel/TOC.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,6 @@
117117
href: sentinel-solutions-delete.md
118118
- name: Manage solution deprecation lifecycle
119119
href: sentinel-solution-deprecation.md
120-
- name: Partner integrations best practices
121-
href: partner-integrations.md
122120
- name: Solution catalog
123121
items:
124122
- name: All solutions
@@ -1140,8 +1138,10 @@
11401138
href: sentinel-content-centralize.md
11411139
- name: Build and publish Microsoft Sentinel solutions
11421140
items:
1143-
- name: Sentinel integration guide
1141+
- name: Overview
11441142
href: sentinel-integration-guide.md
1143+
- name: Partner integrations best practices
1144+
href: partner-integrations.md
11451145
- name: Publish solutions
11461146
href: publish-sentinel-solutions.md
11471147
- name: Solution lifecycle post publish

articles/sentinel/sentinel-integration-guide.md

Lines changed: 41 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -19,101 +19,62 @@ This section covers everything independent software developers (ISVs) need to bu
1919
:::image type="content" source="media/sentinel-integration-guide/sentinel-integration-timeline.png" alt-text="Image showing the end-to-end steps involved in building and publishing solutions to Microsoft Sentinel." lightbox="media/sentinel-integration-guide/sentinel-integration-timeline.png":::
2020

2121
## Learn about Microsoft Sentinel Integrations
22+
To get started, learn about Microsoft Sentinel offers, identify the content you want to build for your product, and find resources to help you learn more about building Microsoft Sentinel solutions.
2223

23-
### Learn about Microsoft Sentinel
24-
Microsoft Sentinel is a scalable, cloud-native security information and event management (SIEM) that delivers an intelligent and comprehensive solution for SIEM and security orchestration, automation, and response (SOAR). Microsoft Sentinel provides cyberthreat detection, investigation, response, and proactive hunting, with a bird's-eye view across your enterprise.
25-
- [What is Microsoft Sentinel?](/azure/sentinel/overview)
26-
27-
### Identify what to build
28-
The most important step to a great integration is deciding which types of content to include in your integration, to match your product’s capabilities. Explore the following resources to understand the types of content you can contribute to Microsoft Sentinel -
29-
30-
- [Technology Integration Scenarios with Microsoft Sentinel](/azure/sentinel/partner-integrations)
31-
- [Building Microsoft Sentinel Integrations - Part 1: Onboarding](https://www.youtube.com/watch?v=eK5bmKhy2iI)
32-
33-
### Review the docs
34-
You find a rich collection of documentation to support with your journey. Here are some key resources to get you started -
35-
36-
- [Guide to building Microsoft Sentinel Solutions](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions#guide-to-building-microsoft-sentinel-solutions)
37-
- [Guide to understand Microsoft Sentinel solution repository in GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions)
38-
- [Guide to understand ASIM (Advanced Security Information Model) Schema](/azure/sentinel/normalization-content)
39-
- [Guide to understand Kusto query language](/archive/blogs/msdn/ben/getting-started-with-the-kusto-query-language)
40-
41-
### Become a Cloud Partner and create a Publisher Account
42-
Microsoft Sentinel solutions are published on the Azure Commercial Marketplace. To publish to the marketplace, join the cloud partner program -
43-
44-
- [Guide to understand Microsoft commercial marketplace](/partner-center/marketplace-offers/overview)
45-
- [Guide to create a commercial marketplace account in Microsoft Partner Center](/partner-center/account-settings/create-account)
46-
- [Join ISV Success program](https://www.microsoft.com/isv/offer-benefits)
47-
- [Sign up for Microsoft for Startups program, if applicable](https://www.microsoft.com/startups)
24+
|Step| Description|
25+
|--|--|
26+
|**Learn about Microsoft Sentinel**| Microsoft Sentinel is a scalable, cloud-native security information and event management (SIEM) that delivers an intelligent and comprehensive solution for SIEM and security orchestration, automation, and response (SOAR). Microsoft Sentinel provides cyberthreat detection, investigation, response, and proactive hunting, with a bird's-eye view across your enterprise. <br><br> For more information, see:<br>[What is Microsoft Sentinel?](/azure/sentinel/overview)|
27+
|**Identify what to build**|The most important step to a great integration is deciding which types of content to include in your integration, to match your product’s capabilities. Explore the following resources to understand the types of content you can contribute to Microsoft Sentinel. <br><br> For more information, see:<br> [Technology Integration Scenarios with Microsoft Sentinel](/azure/sentinel/partner-integrations) <br>[Building Microsoft Sentinel Integrations - Part 1: Onboarding](https://www.youtube.com/watch?v=eK5bmKhy2iI)|
28+
|**Review the docs**|You find a rich collection of documentation to support with your journey. Here are some key resources to get you started. <br><br> For more information, see:<br> [Guide to building Microsoft Sentinel Solutions](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions#guide-to-building-microsoft-sentinel-solutions) <br>[Guide to understand Microsoft Sentinel solution repository in GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions) <br>[Guide to understand ASIM (Advanced Security Information Model) Schema](/azure/sentinel/normalization-content) <br>[Guide to understand Kusto query language](/archive/blogs/msdn/ben/getting-started-with-the-kusto-query-language)|
29+
|**Become a Cloud Partner and create a Publisher Account**|Microsoft Sentinel solutions are published on the Azure Commercial Marketplace. To publish to the marketplace, join the cloud partner program. <br><br> For more information, see:<br> [Guide to understand Microsoft commercial marketplace](/partner-center/marketplace-offers/overview) <br>[Guide to create a commercial marketplace account in Microsoft Partner Center](/partner-center/account-settings/create-account) <br>[Join ISV Success program](https://www.microsoft.com/isv/offer-benefits) <br>[Sign up for Microsoft for Startups program, if applicable](https://www.microsoft.com/startups)|
4830

4931
## Build your solution
32+
Once you have a good understanding of Microsoft Sentinel and the content you want to build, you can start building your solution. This section provides guidance on how to build your solution.
5033

51-
### Provisioning environment
52-
To help you get started with building and testing your solution, we recommend you sign up for an Azure Free Trial and a Microsoft Sentinel Free Trial.
53-
- [Sign up for an Azure Free Trial](https://azure.microsoft.com/pricing/purchase-options/azure-account?icid=azurefreeaccount)
54-
- [Then sign up for a Microsoft Sentinel Free Trial (Scroll down to 'Free trial')](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)
55-
56-
### Complete the training lab
57-
We highly recommend the training lab to get fully ramped up with Microsoft Sentinel. This lab provides hands-on practical experience for product features, capabilities, and scenarios.
58-
59-
- [Complete the Microsoft Sentinel Training Lab](https://azure.microsoft.com/pricing/purchase-options/azure-account?icid=azurefreeaccount)
60-
61-
### Build a connector
62-
Microsoft Sentinel is built on data. Most solutions start with bringing the data from a customer’s environment into Microsoft Sentinel. To understand how to build a connector, refer to the following resources -
63-
64-
- [Guide to Building Microsoft Sentinel Data Experiences](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/ReadMe.md)
65-
- [Webinar: Creating Data Connectors](https://www.youtube.com/watch?v=wXCh17rgtLU)
66-
- [Microsoft Sentinel Tech Blog](https://techcommunity.microsoft.com/category/microsoft-sentinel/blog/microsoftsentinelblog)
67-
68-
### Build your content
69-
In addition to data, your solution can offer a rich array of other components to help customers get the most out of your data. For example, you can offer detections, workbooks, playbooks, and hunting queries to make your offering readily usable by customers. For more information on building content, see [What can you contribute and how can you create contributions?](https://github.com/Azure/Azure-Sentinel/wiki).
70-
71-
### Open GitHub pull request
72-
Once your solution is ready for review, raise a pull request (PR) in the Microsoft Sentinel solutions repository. Microsoft Sentinel engineering staff reviews your PR for best practices.
73-
- [Create a Microsoft Sentinel Pull Request](https://github.com/Azure/Azure-Sentinel?tab=readme-ov-file#pull-request)
34+
|Step| Description|
35+
|--|--|
36+
|**Provisioning environment**|To help you get started with building and testing your solution, we recommend you sign up for an Azure Free Trial and a Microsoft Sentinel Free Trial. <br><br> For more information, see:<br> [Sign up for an Azure Free Trial](https://azure.microsoft.com/pricing/purchase-options/azure-account?icid=azurefreeaccount) <br> [Then sign up for a Microsoft Sentinel Free Trial (Scroll down to 'Free trial')](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)|
37+
|**Complete the training lab**|We highly recommend the training lab to get fully ramped up with Microsoft Sentinel. This lab provides hands-on practical experience for product features, capabilities, and scenarios. <br><br> For more information, see:<br> [Complete the Microsoft Sentinel Training Lab](https://azure.microsoft.com/pricing/purchase-options/azure-account?icid=azurefreeaccount)|
38+
|**Build a connector**|Microsoft Sentinel is built on data. Most solutions start with bringing the data from a customer’s environment into Microsoft Sentinel. To understand how to build a connector, refer to the following resources. <br><br> For more information, see:<br> [Guide to Building Microsoft Sentinel Data Experiences](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/ReadMe.md) <br>[Webinar: Creating Data Connectors](https://www.youtube.com/watch?v=wXCh17rgtLU) <br>[Microsoft Sentinel Tech Blog](https://techcommunity.microsoft.com/category/microsoft-sentinel/blog/microsoftsentinelblog) |
39+
|**Build your content**|In addition to data, your solution can offer a rich array of other components to help customers get the most out of your data. For example, you can offer detections, workbooks, playbooks, and hunting queries to make your offering readily usable by customers. <br><br> For more information, see:<br> [What can you contribute and how can you create contributions?](https://github.com/Azure/Azure-Sentinel/wiki)|
40+
|**Open GitHub pull request**|Once your solution is ready for review, raise a pull request (PR) in the Microsoft Sentinel solutions repository. Microsoft Sentinel engineering staff reviews your PR for best practices. <br><br> For more information, see:<br> [Create a Microsoft Sentinel Pull Request](https://github.com/Azure/Azure-Sentinel?tab=readme-ov-file#pull-request)|
7441

7542
## Test your solution
43+
Once the solution is built, you need to test it to ensure that it meets the quality standards and is ready for publishing. The Microsoft Sentinel engineering staff reviews your solution and provides feedback.
7644

77-
### Resolve technical feedback
78-
After you open your pull request, a member of the Microsoft Sentinel engineering staff will review it for best practices. If more changes are needed before publishing, you find the necessary changes described in the comments attached to the pull request.
79-
80-
### Microsoft merges PR & generates package
81-
Upon the successful completion of all technical feedback, Microsoft Sentinel engineering staff merges the pull request into the main branch, and generates the final package you need to submit with your offer.
45+
|Step| Description|
46+
|--|--|
47+
|**Resolve technical feedback**|After you open your pull request, a member of the Microsoft Sentinel engineering staff reviews it for best practices. If more changes are needed before publishing, you find the necessary changes described in the comments attached to the pull request.|
48+
|**Microsoft merges PR & generates package**|Upon the successful completion of all technical feedback, Microsoft Sentinel engineering staff merges the pull request into the main branch, and generates the final package you need to submit with your offer.|
8249

8350
## Publish to Azure Commercial Marketplace
51+
Once your solution is built, tested, and certified, you can publish it to the Azure Commercial Marketplace. This section provides guidance on how to publish your solution.
8452

85-
### Create an offer
86-
After your solution is merged into the Microsoft Sentinel solutions repository, you’re ready to create an offer in the commercial marketplace. For more information on how to publish your solution, see the following resources -
87-
- [Publish Solutions to Microsoft Sentinel](/azure/sentinel/publish-sentinel-solutions)
88-
89-
### Test Offer Preview
90-
During the preview creation phase, we create a version of your offer that is accessible only to the preview audience you specified. Creating a preview offer ensures that specific audiences test your solution before your solution is broadly shared with all customers.
91-
- [Status of Microsoft Sentinel solution after publishing in the Microsoft Partner center](/azure/sentinel/sentinel-solutions-post-publish-tracking)
92-
93-
### 'Go Live' to Publish Offer
94-
Ensure that you validated all aspects of your solution in preview phase before you make the offer live. Ensure that you validate all aspects of your solution in preview phase before you make the offer live. For more information, see [Publishing a Microsoft Sentinel Solution](/azure/sentinel/sentinel-solutions-post-publish-tracking#step-3-publisher-approval).
95-
96-
### Fix certification issues
97-
Offers submitted to the commercial marketplace must be certified before being published. If your offer fails any of the checks or if you aren't eligible to submit an offer of that type, a certification failure report is sent to your email address. The errors also show up within Action Center in Partner Center. For more information, see [Certification issues](/azure/sentinel/sentinel-solutions-post-publish-tracking#step-4-certification). After the issues are fixed, you can resubmit the offer for certification. This triggers the review process again and once the offer passes certification. Your solution is published to the marketplace and available for customers in Microsoft Sentinel content hub within two working days.
53+
|Step| Description|
54+
|--|--|
55+
|**Create an offer**|After your solution is merged into the Microsoft Sentinel solutions repository, you’re ready to create an offer in the commercial marketplace. For more information on how to publish your solution, see the following resources. <br><br> For more information, see:<br> [Publish Solutions to Microsoft Sentinel](/azure/sentinel/publish-sentinel-solutions)|
56+
|**Test Offer Preview**|During the preview creation phase, we create a version of your offer that is accessible only to the preview audience you specified. Creating a preview offer ensures that specific audiences test your solution before your solution is broadly shared with all customers. <br><br> For more information, see:<br> [Status of Microsoft Sentinel solution after publishing in the Microsoft Partner center](/azure/sentinel/sentinel-solutions-post-publish-tracking)|
57+
|**'Go Live' to Publish Offer**|Ensure that you validated all aspects of your solution in preview phase before you make the offer live. Ensure that you validate all aspects of your solution in preview phase before you make the offer live. <br><br> For more information, see:<br> [Publishing a Microsoft Sentinel Solution](/azure/sentinel/sentinel-solutions-post-publish-tracking#step-3-publisher-approval)|
58+
|**Fix certification issues**|Offers submitted to the commercial marketplace must be certified before being published. If your offer fails any of the checks or if you aren't eligible to submit an offer of that type, a certification failure report is sent to your email address. The errors also show up within Action Center in Partner Center. For more information, see [Certification issues](/azure/sentinel/sentinel-solutions-post-publish-tracking#step-4-certification). After the issues are fixed, you can resubmit the offer for certification. This triggers the review process again and once the offer passes certification. Your solution is published to the marketplace and available for customers in Microsoft Sentinel content hub within two working days.|
9859

9960
## Preview
61+
After your solution is published to the Azure Commercial Marketplace, you can make it available to customers in preview mode. This section provides guidance on how to make your solution available to customers in preview mode.
10062

101-
### Inform customers
102-
Socialize the availability of your solution with your customers so that they can test and provide feedback on the solution.
103-
104-
### Resolve support issues
105-
As customers use the preview version of your solution, they might encounter issues. Be prepared to address these issues as they arise. In addition to issues, customers might also request new features or enhancements. Depending on the feedback, you need to iterate on your solution before making it generally available.
106-
107-
### Continue for four weeks
108-
We recommend keeping your solution in preview for at least four weeks to gather feedback from customers and address any issues that arise.
63+
|Step| Description|
64+
|--|--|
65+
|**Inform customers**|Socialize the availability of your solution with your customers so that they can test and provide feedback on the solution.|
66+
|**Resolve support issues**|As customers use the preview version of your solution, they might encounter issues. Be prepared to address these issues as they arise. In addition to issues, customers might also request new features or enhancements. Depending on the feedback, you need to iterate on your solution before making it generally available.|
67+
|**Continue for four weeks**|We recommend keeping your solution in preview for at least four weeks to gather feedback from customers and address any issues that arise.|
10968

11069
## Go to Market (GTM)
70+
After your solution is in preview for at least four weeks and you address any issues that customers encounter, you can make your solution generally available to all customers.
11171

112-
### Remove preview flag
113-
After the preview period, you can remove the preview flag from your offer to make it generally available to all customers.
72+
|Step| Description|
73+
|--|--|
74+
|**Remove preview flag**|After the preview period, you can remove the preview flag from your offer to make it generally available to all customers.|
75+
|**Listen for customer feedback**|Continue to monitor feedback and support requests as your solution gains traction.|
76+
|**Enhance solution**|Based on customer feedback, you might need to enhance your solution to meet customer needs. Customer feedback might require the addition of new features, improving performance, or addressing any issues that customers encounter.|
11477

115-
### Listen for customer feedback
116-
Continue to monitor feedback and support requests as your solution gains traction.
78+
## Related content
11779

118-
### Enhance solution
119-
Based on customer feedback, you might need to enhance your solution to meet customer needs. Customer feedback might require the addition of new features, improving performance, or addressing any issues that customers encounter.
80+
[Publish solutions to Microsoft Sentinel](/azure/sentinel/publish-sentinel-solutions)

0 commit comments

Comments
 (0)