You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This section covers prerequisites and general installation instructions for the group of data connectors that use standalone diagnostic settings-based connections.
24
+
To ingest data into Microsoft Sentinel using a standalone, diagnostic settings-based connector, you must have read and write permissions on the Log Analytics workspace enabled for Microsoft Sentinel.
25
25
26
-
### Prerequisites
26
+
To ingest data into Microsoft Sentinel using diagnostic settings-based connectors managed by Azure Policy, you must also have the following prerequisites:
27
27
28
-
To ingest data into Microsoft Sentinel:
28
+
- To use Azure Policy to apply a log streaming policy to your resources, you must have the Owner role for the policy assignment scope.
29
+
30
+
- The following prerequisites, depending on which connector you're using:
29
31
30
-
- You must have read and write permissions on the Microsoft Sentinel workspace.
32
+
|Data connector |Licensing, costs, and other information |
33
+
|---------|---------|
34
+
|**Azure Activity**| This connector now uses the diagnostic settings pipeline. If you're using the legacy method, you must disconnect the existing subscriptions from the legacy method before setting up the new Azure Activity log connector.<br><br>1. From the Microsoft Sentinel navigation menu, select **Data connectors**. From the list of connectors, select **Azure Activity**, and then select the **Open connector page** button on the lower right.<br>2. Under the **Instructions** tab, in the **Configuration** section, in step 1, review the list of your existing subscriptions that are connected to the legacy method, and disconnect them all at once by clicking the **Disconnect All** button below.<br>3. Continue setting up the new connector with the instructions in this section. |
35
+
|**Azure DDoS Protection**|- Configured [Azure DDoS Standard protection plan](../ddos-protection/manage-ddos-protection.md#create-a-ddos-protection-plan).<br>- Configured [virtual network with Azure DDoS Standard enabled](../ddos-protection/manage-ddos-protection.md#enable-for-a-new-virtual-network)<br>- Other charges may apply<br>- The **Status** for Azure DDoS Protection Data Connector changes to **Connected** only when the protected resources are under a DDoS attack.|
36
+
|**Azure Storage Account**|The storage account (parent) resource has within it other (child) resources for each type of storage: files, tables, queues, and blobs.</br>When configuring diagnostics for a storage account, you must select and configure: <br><br>- The parent account resource, exporting the **Transaction** metric.<br>- Each of the child storage-type resources, exporting all the logs and metrics.<br><br>You will only see the storage types that you actually have defined resources for.|
31
37
32
-
### Instructions
38
+
## Connect via a standalone diagnostic settings-based connector
39
+
40
+
This procedure describes how to connect to Microsoft Sentinel using data connectors that use standalone connections based on diagnostic settings.
33
41
34
42
1. From the Microsoft Sentinel navigation menu, select **Data connectors**.
35
43
@@ -53,27 +61,9 @@ To ingest data into Microsoft Sentinel:
53
61
54
62
For more information, see also [Create diagnostic settings to send Azure Monitor platform logs and metrics to different destinations](/azure/azure-monitor/essentials/diagnostic-settings) in the Azure Monitor documentation.
This section covers prerequisites and general installation instructions for the group of data connectors that use Azure Policy managed diagnostic settings-based connections.
59
-
60
-
### Prerequisites
61
-
62
-
To ingest data into Microsoft Sentinel:
63
-
64
-
- You must have read and write permissions on the Microsoft Sentinel workspace.
65
-
66
-
- To use Azure Policy to apply a log streaming policy to your resources, you must have the Owner role for the policy assignment scope.
67
-
68
-
- Data connector specific requirements:
69
-
70
-
|Data connector |Licensing, costs, and other information |
71
-
|---------|---------|
72
-
|Azure Activity| This connector now uses the diagnostic settings pipeline. If you're using the legacy method, you must disconnect the existing subscriptions from the legacy method before setting up the new Azure Activity log connector.<br><br>1. From the Microsoft Sentinel navigation menu, select **Data connectors**. From the list of connectors, select **Azure Activity**, and then select the **Open connector page** button on the lower right.<br>2. Under the **Instructions** tab, in the **Configuration** section, in step 1, review the list of your existing subscriptions that are connected to the legacy method, and disconnect them all at once by clicking the **Disconnect All** button below.<br>3. Continue setting up the new connector with the instructions in this section. |
73
-
|Azure DDoS Protection|- Configured [Azure DDoS Standard protection plan](../ddos-protection/manage-ddos-protection.md#create-a-ddos-protection-plan).<br>- Configured [virtual network with Azure DDoS Standard enabled](../ddos-protection/manage-ddos-protection.md#enable-for-a-new-virtual-network)<br>- Other charges may apply<br>- The **Status** for Azure DDoS Protection Data Connector changes to **Connected** only when the protected resources are under a DDoS attack.|
74
-
|Azure Storage Account|The storage account (parent) resource has within it other (child) resources for each type of storage: files, tables, queues, and blobs.</br>When configuring diagnostics for a storage account, you must select and configure: <br><br>- The parent account resource, exporting the **Transaction** metric.<br>- Each of the child storage-type resources, exporting all the logs and metrics.<br><br>You will only see the storage types that you actually have defined resources for.|
64
+
## Connect via a diagnostic setting-based connector managed by Azure Policy
75
65
76
-
### Instructions
66
+
This procedure descibes how to connect to Microsoft Sentinel using data connectors that use connections that are based on diagnostic settings and are managed by Azure Policy.
77
67
78
68
Connectors of this type use Azure Policy to apply a single diagnostic settings configuration to a collection of resources of a single type, defined as a scope. You can see the log types ingested from a given resource type on the left side of the connector page for that resource, under **Data types**.
79
69
@@ -101,9 +91,9 @@ With this type of data connector, the connectivity status indicators (a color st
101
91
102
92
You can find and query the data for each resource type using the table name that appears in the section for the resource's connector in the [Data connectors reference](data-connectors-reference.md) page. For more information, see [Create diagnostic settings to send Azure Monitor platform logs and metrics to different destinations](/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD) in the Azure Monitor documentation.
0 commit comments