How to Connect Data Sources to Microsoft Sentinel

Microsoft Sentinel integrates with over 350 data sources through built-in connectors, enabling comprehensive security monitoring across your entire environment. This guide walks you through connecting various data sources to build a unified security operations platform.

Prerequisites

Before connecting data sources, ensure you have:

• Microsoft Sentinel workspace deployed in your Azure subscription
• Appropriate Azure RBAC permissions (Microsoft Sentinel Contributor or higher)
• Content Hub access to install required solutions
• Data source credentials or API keys for third-party services
• Network connectivity allowing outbound HTTPS (443) from agents if using on-premises sources

Understanding Data Connector Types

Microsoft Sentinel offers several connector categories to accommodate different data sources:

Step 1: Access the Data Connectors Page

Via the Defender Portal (Recommended)

1. Navigate to the Microsoft Defender portal at https://security.microsoft.com
2. Select Microsoft Sentinel from the navigation menu
3. Choose your workspace if you have multiple
4. Go to Configuration > Data connectors

Via the Azure Portal

1. Navigate to the Azure portal at https://portal.azure.com
2. Search for Microsoft Sentinel
3. Select your workspace
4. Under Configuration, click Data connectors

Step 2: Install Required Solutions from Content Hub

Many data connectors require installing the corresponding solution from the Content Hub first:

1. In Microsoft Sentinel, go to Content management > Content hub
2. Search for the solution matching your data source (e.g., "Microsoft Defender for Cloud")
3. Click on the solution to view details
4. Click Install or Update if already installed
5. Wait for installation to complete (typically 1-2 minutes)

Tip: Installing a solution often includes analytics rules, workbooks, and hunting queries in addition to the data connector.

Step 3: Connect Microsoft Services

Microsoft services offer the simplest integration experience with service-to-service connectors.

Connect Microsoft Entra ID (Azure AD)

1. In Data connectors, search for "Microsoft Entra ID"
2. Click on the connector and select Open connector page
3. Review the Prerequisites section
4. Under Configuration, select the log types to enable:
   • Sign-in logs - User authentication events
   • Audit logs - Directory changes and admin activities
   • Provisioning logs - User provisioning events
   • Risky users - Identity Protection risk data
5. Click Apply Changes

Connect Microsoft Defender XDR

1. Search for "Microsoft Defender XDR" in Data connectors
2. Open the connector page
3. Under Configuration, select Connect incidents & alerts
4. Choose the Defender products to include:
   • Microsoft Defender for Endpoint
   • Microsoft Defender for Office 365
   • Microsoft Defender for Identity
   • Microsoft Defender for Cloud Apps
5. Enable Turn off all Microsoft incident creation rules to avoid duplicates
6. Click Apply Changes

Connect Microsoft 365

1. Install the "Microsoft 365" solution from Content Hub
2. Open the Office 365 connector
3. Select the data types to ingest:
   • Exchange - Email audit logs
   • SharePoint - Document activity
   • Teams - Collaboration events
4. Click Apply Changes

Step 4: Connect Third-Party Cloud Services

Connect Amazon Web Services (AWS)

1. Install the "Amazon Web Services" solution from Content Hub
2. Open the Amazon Web Services connector
3. Review prerequisites:
   • AWS account with CloudTrail enabled
   • IAM role with appropriate permissions
4. In AWS Console, create an IAM role:
   • Trust relationship allowing your Azure tenant
   • Attach the required policy for CloudTrail access
5. In Sentinel, enter your:
   • AWS Account ID
   • Role ARN from the created IAM role
6. Click Add to connect

Connect Okta

1. Install the "Okta Single Sign-On" solution
2. Open the Okta SSO connector
3. Generate an API token in your Okta admin console:
   • Go to Security > API > Tokens
   • Create a new token with read permissions
4. In Sentinel, enter:
   • Okta domain (e.g., yourcompany.okta.com)
   • API Token
5. Click Connect

Step 5: Connect On-Premises Sources with Agents

Install Azure Monitor Agent (AMA)

For Windows servers:

1. In the Azure portal, navigate to your server's Virtual Machine resource
2. Go to Settings > Extensions + applications
3. Click Add and select Azure Monitor Agent
4. Configure the agent settings and install

For Linux servers:

# Download and install the AMA
wget https://aka.ms/InstallAzureMonitorAgentLinux -O InstallDCRAgent.sh
sudo bash InstallDCRAgent.sh

Create Data Collection Rules (DCR)

1. In Microsoft Sentinel, go to Configuration > Data collection rules
2. Click Create
3. Configure the rule:
   • Name: Descriptive name for the rule
   • Platform type: Windows or Linux
   • Data sources: Select log types (Windows Events, Syslog, etc.)
   • Destination: Your Log Analytics workspace
4. Add resources (VMs) that should use this rule
5. Click Create

Connect Syslog Sources

1. Deploy a Linux log forwarder VM if collecting from network devices
2. Install the Azure Monitor Agent on the forwarder
3. Configure the Syslog daemon to receive logs:

# Edit rsyslog configuration
sudo nano /etc/rsyslog.conf

# Add these lines to enable UDP and TCP reception
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")

4. Restart the Syslog service:

sudo systemctl restart rsyslog

5. Configure your network devices to send logs to the forwarder's IP address

Connect CEF Sources

Common Event Format (CEF) provides standardized logging for security devices:

1. Install the AMA on your log forwarder
2. Create a DCR for CEF data collection
3. Configure your security appliance to send CEF-formatted logs to the forwarder
4. Verify data in the CommonSecurityLog table

Step 6: Verify Data Ingestion

Check Connector Status

1. Return to the Data connectors page
2. Locate your connected source
3. Verify the status shows Connected (green indicator)
4. Review the Data received graph for recent activity

Run Verification Queries

Open Logs and run queries to confirm data is flowing:

// Check Microsoft Entra ID sign-in logs
SigninLogs
| where TimeGenerated > ago(1h)
| take 10

// Check Windows Security Events
SecurityEvent
| where TimeGenerated > ago(1h)
| summarize count() by EventID
| order by count_ desc

// Check Syslog data
Syslog
| where TimeGenerated > ago(1h)
| summarize count() by Facility, SeverityLevel

Monitor Ingestion Health

1. Go to Settings > Workspace settings
2. Click on Logs under your Log Analytics workspace
3. Run the workspace health query:

Usage
| where TimeGenerated > ago(24h)
| summarize TotalGB = sum(Quantity)/1000 by DataType
| order by TotalGB desc

Troubleshooting Common Issues

Data Not Appearing After Connection

Symptoms: Connector shows connected but no data in logs.

Solutions:

1. Wait at least 2 hours for initial data ingestion
2. Verify permissions on both the source and Sentinel workspace
3. Check the connector's diagnostic logs for errors
4. Ensure required APIs are enabled (for cloud services)
5. Verify network connectivity from agents to Azure

Agent Communication Failures

Symptoms: On-premises agent shows disconnected.

Solutions:

1. Verify outbound HTTPS (443) connectivity to Azure
2. Check proxy settings if applicable
3. Restart the Azure Monitor Agent service
4. Review agent logs for specific errors

High Data Volume Warnings

Symptoms: Unexpected data ingestion costs or volume alerts.

Solutions:

1. Review which log types are enabled and disable unnecessary ones
2. Implement data collection rules to filter events
3. Use transformation rules to reduce data before ingestion
4. Consider archiving to the Sentinel data lake for long-term storage

Best Practices for Data Connectors

Next Steps

After connecting your data sources:

1. Create analytics rules to detect threats in your ingested data
2. Build workbooks to visualize security metrics
3. Configure automation to respond to detected incidents
4. Set up hunting queries to proactively search for threats
5. Review cost management to optimize your data retention strategy

Additional Resources

• Microsoft Sentinel Data Connectors Reference
• Azure Monitor Agent Overview
• Content Hub Solutions

Need help with your Microsoft Sentinel deployment? Inventive HQ provides expert SIEM implementation services, from initial data source integration to advanced analytics configuration. Contact us for a free consultation.