| title | description | author | ms.topic | ms.date | ms.author | appliesto | ms.collection | ||
|---|---|---|---|---|---|---|---|---|---|
Find your Microsoft Sentinel data connector | Microsoft Docs |
Learn about specific configuration steps for Microsoft Sentinel data connectors. |
cwatson-cat |
reference |
04/26/2024 |
cwatson |
|
usx-security |
This article lists all supported, out-of-the-box data connectors and links to each connector's deployment steps.
Important
- Noted Microsoft Sentinel data connectors are currently in Preview. The Azure Preview Supplemental Terms include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
- For connectors that use the Log Analytics agent, the agent will be retired on 31 August, 2024. If you are using the Log Analytics agent in your Microsoft Sentinel deployment, we recommend that you start planning your migration to the AMA. For more information, see AMA migration for Microsoft Sentinel.
- [!INCLUDE unified-soc-preview-without-alert]
Data connectors are available as part of the following offerings:
-
Solutions: Many data connectors are deployed as part of Microsoft Sentinel solution together with related content like analytics rules, workbooks, and playbooks. For more information, see the Microsoft Sentinel solutions catalog.
-
Community connectors: More data connectors are provided by the Microsoft Sentinel community and can be found in the Azure Marketplace. Documentation for community data connectors is the responsibility of the organization that created the connector.
-
Custom connectors: If you have a data source that isn't listed or currently supported, you can also create your own, custom connector. For more information, see Resources for creating Microsoft Sentinel custom connectors.
[!INCLUDE reference-to-feature-availability]
[!INCLUDE data-connector-prereq]
- Armis Activities (using Azure Functions)
- Armis Alerts (using Azure Functions)
- Armis Devices (using Azure Functions)
- Cisco Application Centric Infrastructure
- Cisco ASA/FTD via AMA (Preview)
- Cisco Duo Security (using Azure Functions)
- Cisco Identity Services Engine
- Cisco Meraki
- Cisco Secure Endpoint (AMP) (using Azure Functions)
- Cisco Stealthwatch
- Cisco UCS
- Cisco Umbrella (using Azure Functions)
- Cisco Web Security Appliance
- Crowdstrike Falcon Data Replicator (using Azure Functions)
- Crowdstrike Falcon Data Replicator V2 (using Azure Functions) (Preview)
- [Deprecated] FireEye Network Security (NX) via Legacy Agent
- [Recommended] FireEye Network Security (NX) via AMA
- Google Cloud Platform DNS (using Azure Functions)
- Google Cloud Platform IAM (using Azure Functions)
- Google Cloud Platform Cloud Monitoring (using Azure Functions)
- Google ApigeeX (using Azure Functions)
- Google Workspace (G Suite) (using Azure Functions)
- Island Enterprise Browser Admin Audit (Polling CCP)
- Island Enterprise Browser User Activity (Polling CCP)
- [Deprecated] Kaspersky Security Center via Legacy Agent
- [Recommended] Kaspersky Security Center via AMA
- Lookout (using Azure Function)
- Lookout Cloud Security for Microsoft Sentinel (using Azure Functions)
- Automated Logic WebCTRL
- Microsoft Entra ID
- Microsoft Entra ID Protection
- Azure Activity
- Azure Cognitive Search
- Azure DDoS Protection
- Azure Key Vault
- Azure Kubernetes Service (AKS)
- Microsoft Purview (Preview)
- Azure Storage Account
- Azure Web Application Firewall (WAF)
- Azure Batch Account
- Common Event Format (CEF)
- Common Event Format (CEF) via AMA
- Windows DNS Events via AMA
- Azure Event Hub
- Microsoft 365 Insider Risk Management
- Azure Logic Apps
- Microsoft Defender for Identity
- Microsoft Defender XDR
- Microsoft Defender for Cloud Apps
- Microsoft Defender for Endpoint
- Subscription-based Microsoft Defender for Cloud (Legacy)
- Tenant-based Microsoft Defender for Cloud (Preview)
- Microsoft Defender for Office 365 (Preview)
- Microsoft PowerBI
- Microsoft Project
- Microsoft Purview Information Protection
- Network Security Groups
- Microsoft 365
- Security Events via Legacy Agent
- Windows Security Events via AMA
- Azure Service Bus
- Azure Stream Analytics
- Syslog
- Syslog via AMA
- Microsoft Defender Threat Intelligence (Preview)
- Threat intelligence - TAXII
- Threat Intelligence Platforms
- Threat Intelligence Upload Indicators API (Preview)
- Microsoft Defender for IoT
- Windows Firewall
- Windows Firewall Events via AMA (Preview)
- Windows Forwarded Events
- [Deprecated] Forcepoint CASB via Legacy Agent
- [Deprecated] Forcepoint CSG via Legacy Agent
- [Deprecated] Forcepoint NGFW via Legacy Agent
- [Recommended] Forcepoint CASB via AMA
- [Recommended] Forcepoint CSG via AMA
- [Recommended] Forcepoint NGFW via AMA
- Barracuda CloudGen Firewall
- Exchange Security Insights Online Collector (using Azure Functions)
- Exchange Security Insights On-Premise Collector
- Microsoft Exchange Logs and Events
- Forcepoint DLP
- MISP2Sentinel
- Mimecast Audit & Authentication (using Azure Functions)
- Mimecast Secure Email Gateway (using Azure Functions)
- Mimecast Intelligence for Microsoft - Microsoft Sentinel (using Azure Functions)
- Mimecast Targeted Threat Protection (using Azure Functions)
- Oracle Cloud Infrastructure (using Azure Functions)
- Oracle Database Audit
- Oracle WebLogic Server (using Azure Functions)
- [Deprecated] Palo Alto Networks Cortex Data Lake (CDL) via Legacy Agent
- [Recommended] Palo Alto Networks Cortex Data Lake (CDL) via AMA
- Palo Alto Prisma Cloud CSPM (using Azure Functions)
- Qualys Vulnerability Management (using Azure Functions)
- Qualys VM KnowledgeBase (using Azure Functions)
- Symantec Endpoint Protection
- Symantec VIP
- Symantec ProxySG
- Symantec Integrated Cyber Defense Exchange
For more information, see: