Built-in Azure role that includes everything Responder can do and can also create and modify workbooks, analytics rules and content hub solutions.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Sentinel Contributor in context, with comparison tables and the common traps.
Terms in this definition
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- CRUD
Shorthand for create, read, update and delete, the four basic things you do with data. Data-plane roles in Azure Cosmos DB, for instance, authorise those operations on items.
- Modify
Policy effect in Azure that can add, replace or remove tags and other properties. Resources that already exist are brought into line by running a remediation task.
- Azure Monitor workbooks
Reports in Azure that you can interact with, mixing KQL queries, metrics, parameters and text. Send Intune logs to Log Analytics and you can build them on that data.
- Content hub
Lets you browse and install Microsoft Sentinel solutions, or standalone items such as playbooks, workbooks, hunting queries, analytics rules and data connectors, all supplied out of the box.
Related terms
- Summary rule
Aggregates high-volume logs, cheap-tier data included, on a schedule in the background using KQL, writing the results to a custom analytics-tier table that is fast to query. Creating one requires the Microsoft Sentinel Contributor role.
- Upload API
Successor to the deprecated platform connector: a TIP or your own app pushes STIX objects straight into Sentinel over REST, with no data connector, signing in as an Entra app that holds Microsoft Sentinel Contributor. The endpoint is per workspace, and the API is still in preview.