Brings data into the Microsoft Sentinel workspace from Azure resources, Microsoft services or third-party sources; ingestion is its only job, with no detection or response.
Also called Microsoft Sentinel data connector.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Data connector in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Sentinel
Microsoft's cloud-native SIEM, with SOAR capabilities, which stores and queries its data in a Log Analytics workspace.
- Workspace
Teams in Power BI and Microsoft Fabric collaborate in this folder-style container, which groups items such as reports, semantic models and lakehouses, controls who can access them and is assigned a capacity.
- Job
A sequence of steps executed together on one agent or runner, or on the server for agentless work. While running, each occupies one of your parallel jobs.
Related terms
- CEF via AMA
Sentinel data connector in which a Linux forwarder runs the Azure Monitor Agent with a DCR to receive CEF messages; it supersedes the older CEF connector built on the Log Analytics agent.
- Custom Logs via AMA
Collects text-file logs into a _CL table, using the Azure Monitor Agent plus a data collection rule, from Windows or Linux machines or a log forwarder. It is a Microsoft Sentinel data connector still in preview.
- Upload API
Successor to the deprecated platform connector: a TIP or your own app pushes STIX objects straight into Sentinel over REST, with no data connector, signing in as an Entra app that holds Microsoft Sentinel Contributor. The endpoint is per workspace, and the API is still in preview.