You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/sentinel-integration-guide.md
+44-44Lines changed: 44 additions & 44 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,108 +12,108 @@ ms.date: 01/07/2025
12
12
13
13
# Build and publish Microsoft Sentinel solutions
14
14
15
-
Security Operations teams use Microsoft Sentinel to generate detections and investigate and remediate threats. Offering your data, detections, automation, analysis and packaged expertise, to customers via integration with Microsoft Sentinel enables security teams with the right information at the right time to execute informed security responses.
15
+
Security Operations teams generate detections, investigate, and remediate threats using Microsoft Sentinel. By integrating your data, detections, automation, analysis, and packaged expertisewith Microsoft Sentinel, you enable security teams to have the right information at the right time to execute informed security responses.
16
16
17
17
This section covers everything independent software developers (ISVs) need to build and optimize high-quality solutions for Microsoft Sentinel. At a high level, the roadmap to success from concept to completion contains the following steps. In the remainder of this article, you find details on how to proceed with each step in your journey.
18
18
19
19
:::image type="content" source="media/sentinel-integration-guide/sentinel-integration-timeline.png" alt-text="Image showing the end-to-end steps involved in building and publishing solutions to Microsoft Sentinel." lightbox="media/sentinel-integration-guide/sentinel-integration-timeline.png":::
20
20
21
-
# Learn about Microsoft Sentinel Integrations
21
+
##Learn about Microsoft Sentinel Integrations
22
22
23
-
## What is Microsoft Sentinel?
23
+
###What is Microsoft Sentinel?
24
24
Microsoft Sentinel is a scalable, cloud-native security information and event management (SIEM) that delivers an intelligent and comprehensive solution for SIEM and security orchestration, automation, and response (SOAR). Microsoft Sentinel provides cyberthreat detection, investigation, response, and proactive hunting, with a bird's-eye view across your enterprise.
25
25
-[What is Microsoft Sentinel?](/azure/sentinel/overview)
26
26
27
-
## What should I build?
27
+
###What should I build?
28
28
The most important step to a great integration is deciding which types of content to include in your integration, to match your product’s capabilities. Explore the following resources to understand the types of content you can contribute to Microsoft Sentinel -
29
29
30
30
-[Technology Integration Scenarios with Microsoft Sentinel](/azure/sentinel/partner-integrations)
31
31
-[Building Microsoft Sentinel Integrations - Part 1: Onboarding](https://www.youtube.com/watch?v=eK5bmKhy2iI)
32
32
33
-
## Review the docs
34
-
You find a rich collection of documentation to support with your journey. Below are some key resources to get you started -
33
+
###Review the docs
34
+
You find a rich collection of documentation to support with your journey. Here are some key resources to get you started -
35
35
36
36
-[Guide to building Microsoft Sentinel Solutions](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions#guide-to-building-microsoft-sentinel-solutions)
37
-
-[Become familiar with Microsoft Sentinel Solutions repo on GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions)
38
-
-[ASIM Normalized Schema: Advanced Security Information Model (ASIM) security content | Microsoft Docs](/azure/sentinel/normalization-content)
39
-
-[Kusto query language: Getting Started with the Kusto Query Language (KQL) | Microsoft Docs](/archive/blogs/msdn/ben/getting-started-with-the-kusto-query-language)
37
+
-[Guide to understand Microsoft Sentinel solution repository in GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions)
38
+
-[Guide to understand ASIM (Advanced Security Information Model) Schema](/azure/sentinel/normalization-content)
39
+
-[Guide to understand Kusto query language](/archive/blogs/msdn/ben/getting-started-with-the-kusto-query-language)
40
40
41
-
## Become a Cloud Partner and create a Publisher Account
41
+
###Become a Cloud Partner and create a Publisher Account
42
42
Microsoft Sentinel solutions are published on the Azure Commercial Marketplace. To publish to the marketplace, join the cloud partner program -
43
43
44
-
-[Overview of the Microsoft commercial marketplace](/partner-center/marketplace-offers/overview)
45
-
-[Create a commercial marketplace account in Partner Center](/partner-center/account-settings/create-account)
44
+
-[Guide to understand Microsoft commercial marketplace](/partner-center/marketplace-offers/overview)
45
+
-[Guide to create a commercial marketplace account in Microsoft Partner Center](/partner-center/account-settings/create-account)
-[Sign up for Microsoft for Startups program, if applicable](https://www.microsoft.com/startups)
48
48
49
-
# Build your solution
49
+
##Build your solution
50
50
51
-
##Provision environment
51
+
### Provisioning environment
52
52
To help you get started with building and testing your solution, we recommend you sign up for an Azure Free Trial and a Microsoft Sentinel Free Trial.
53
-
-[Sign up for an Azure Free Trial](https://azure.microsoft.com/pricing/purchase-options/azure-account?icid=azurefreeaccount)
53
+
-[Sign up for an Azure Free Trial](https://azure.microsoft.com/pricing/purchase-options/azure-account?icid=azurefreeaccount)
54
54
-[Then sign up for a Microsoft Sentinel Free Trial (Scroll down to 'Free trial')](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)
55
55
56
-
## Complete the training lab
56
+
###Complete the training lab
57
57
We highly recommend the training lab to get fully ramped up with Microsoft Sentinel. This lab provides hands-on practical experience for product features, capabilities, and scenarios.
58
58
59
59
-[Complete the Microsoft Sentinel Training Lab](https://azure.microsoft.com/pricing/purchase-options/azure-account?icid=azurefreeaccount)
60
60
61
-
## Build a connector
61
+
###Build a connector
62
62
Microsoft Sentinel is built on data. Most solutions start with bringing the data from a customer’s environment into Microsoft Sentinel. To understand how to build a connector, refer to the following resources -
63
63
64
64
-[Guide to Building Microsoft Sentinel Data Experiences](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/ReadMe.md)
65
65
-[Webinar: Creating Data Connectors](https://www.youtube.com/watch?v=wXCh17rgtLU)
In addition to data, your solution can offer a rich array of other components to help customers get the most out of your data. For example, you can offer detections, workbooks, playbooks, and hunting queries to make your offering readily usable by customers. For more information on building content, see [What can you contribute and how can you create contributions?](https://github.com/Azure/Azure-Sentinel/wiki).
70
70
71
-
## Open a pull request
72
-
Once your solution is ready for review, raise a pull request (PR) in the Microsoft Sentinel solutions repository. The PR will be reviewed by the Microsoft Sentinel engineering staff for best practices.
71
+
### Open a pull request
72
+
Once your solution is ready for review, raise a pull request (PR) in the Microsoft Sentinel solutions repository. Microsoft Sentinel engineering staff reviews your PR for best practices.
73
73
-[Create a Microsoft Sentinel Pull Request](https://github.com/Azure/Azure-Sentinel?tab=readme-ov-file#pull-request)
74
74
75
-
# Test your solution
75
+
##Test your solution
76
76
77
-
## Resolve technical feedback
78
-
After opening your pull request, a member of the Microsoft Sentinel engineering staff will review for best practices. If more changes are needed before publishing, you'll find the necessary changes described in the comments attached to the pull request.
77
+
###Resolve technical feedback
78
+
After you open your pull request, a member of the Microsoft Sentinel engineering staff will review it for best practices. If more changes are needed before publishing, you find the necessary changes described in the comments attached to the pull request.
79
79
80
-
## Microsoft merges PR & generates package
81
-
Upon the successful completion of all technical feedback, Microsoft Sentinel engineering staff merges the pull request into the main branch, and generate the final package you need to submit with your offer.
80
+
###Microsoft merges PR & generates package
81
+
Upon the successful completion of all technical feedback, Microsoft Sentinel engineering staff merges the pull request into the main branch, and generates the final package you need to submit with your offer.
82
82
83
-
# Publish to Azure Commercial Marketplace
83
+
##Publish to Azure Commercial Marketplace
84
84
85
-
## Create an offer
86
-
After your solution has been merged into the Microsoft Sentinel solutions repository, you’re ready to create an offer in the commercial marketplace. For more information on how to publish your solution, see the following resources -
85
+
###Create an offer
86
+
After your solution is merged into the Microsoft Sentinel solutions repository, you’re ready to create an offer in the commercial marketplace. For more information on how to publish your solution, see the following resources -
87
87
-[Publish Solutions to Microsoft Sentinel](/azure/sentinel/publish-sentinel-solutions)
88
88
89
-
## Test Offer Preview
90
-
During the preview creation phase, we create a version of your offer that is accessible only to the preview audience you specified during offer creation. This is to ensure that your solution can be tested by specific audience that you configure before it's broadly shared with all customers.
89
+
###Test Offer Preview
90
+
During the preview creation phase, we create a version of your offer that is accessible only to the preview audience you specified. Creating a preview offer ensures that specific audiences test your solution before your solution is broadly shared with all customers.
91
91
-[Status of Microsoft Sentinel solution after publishing in the Microsoft Partner center](/azure/sentinel/sentinel-solutions-post-publish-tracking)
92
92
93
-
## 'Go Live' to Publish Offer
93
+
###'Go Live' to Publish Offer
94
94
Ensure that you validated all aspects of your solution in preview phase before you make the offer live. Ensure that you validate all aspects of your solution in preview phase before you make the offer live. For more information, see [Publishing a Microsoft Sentinel Solution](/azure/sentinel/sentinel-solutions-post-publish-tracking#step-3-publisher-approval).
95
95
96
-
## Fix certification issues
97
-
Offers submitted to the commercial marketplace must be certified before being published. If your offer fails any of the checks or if you aren't eligible to submit an offer of that type, a certification failure report is sent to your email address. The errors also show up within Action Center in Partner Center. For more information, see [Certification issues](/azure/sentinel/sentinel-solutions-post-publish-tracking#step-4-certification).
96
+
###Fix certification issues
97
+
Offers submitted to the commercial marketplace must be certified before being published. If your offer fails any of the checks or if you aren't eligible to submit an offer of that type, a certification failure report is sent to your email address. The errors also show up within Action Center in Partner Center. For more information, see [Certification issues](/azure/sentinel/sentinel-solutions-post-publish-tracking#step-4-certification). After the issues are fixed, you can resubmit the offer for certification. This triggers the review process again and once the offer passes certification. Your solution is published to the marketplace and available for customers in Microsoft Sentinel content hub within two working days.
98
98
99
-
# Preview
99
+
##Preview
100
100
101
-
## Inform customers
101
+
###Inform customers
102
102
Socialize the availability of your solution with your customers so that they can test and provide feedback on the solution.
103
103
104
-
## Resolve support issues
105
-
As customers use the preview version of your solution, they may encounter issues. Be prepared to address these issues as they arise. In addition to issues, customers may also request new features or enhancements. Depending on the feedback, you may need to iterate on your solution before making it generally available.
104
+
###Resolve support issues
105
+
As customers use the preview version of your solution, they might encounter issues. Be prepared to address these issues as they arise. In addition to issues, customers might also request new features or enhancements. Depending on the feedback, you need to iterate on your solution before making it generally available.
106
106
107
-
## Continue for four weeks
107
+
###Continue for four weeks
108
108
We recommend keeping your solution in preview for at least four weeks to gather feedback from customers and address any issues that arise.
109
109
110
-
# Go to Market
110
+
##Go to Market (GTM)
111
111
112
-
## Remove preview flag
112
+
###Remove preview flag
113
113
After the preview period, you can remove the preview flag from your offer to make it generally available to all customers.
114
114
115
-
## Listen for customers feedback
116
-
Continue to monitor feedback and support requests as your solution gains traction. This ensures that you can quickly address any issues that arise.
115
+
###Listen for customer feedback
116
+
Continue to monitor feedback and support requests as your solution gains traction.
117
117
118
-
## Enhance solution
119
-
Based on customer feedback, you may need to enhance your solution to meet customer needs. Be prepared to iterate on your solution to ensure that it meets the needs of your customers.
118
+
###Enhance solution
119
+
Based on customer feedback, you might need to enhance your solution to meet customer needs. Customer feedback might require the addition of new features, improving performance, or addressing any issues that customers encounter.
0 commit comments