Skip to content

Commit 7d036bd

Browse files
committed
fix
1 parent 71b2cda commit 7d036bd

1 file changed

Lines changed: 22 additions & 13 deletions

File tree

articles/sentinel/create-push-codeless-connector.md

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,25 @@ CCF Push provide several key benefits:
2525
- **Template-based provisioning:** Deployment creates ARM templates for DCRs, custom tables, Entra application registration, and client secrets - you receive the connection details to configure in your sending application
2626
- **Secure authentication:** Uses Microsoft Entra applications with OAuth 2.0 for secure data submission
2727

28+
29+
## Prerequisites
30+
31+
- Before you begin, you must have access to the Azure-Sentinel GitHub repository for packaging tools.
32+
- Microsoft Entra permissions:
33+
- Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher.
34+
- Permission to create an application with secrets. Note: The connector fails if Entra applications can't be created with secrets due to security reasons.
35+
- Microsoft Azure permissions:
36+
- Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role.
37+
### Prerequisites
38+
39+
- Before you begin, you must have access to the Azure-Sentinel GitHub repository for packaging tools.
40+
- Microsoft Entra permissions:
41+
- Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher.
42+
- Permission to create an application with secrets. Note: The connector fails if Entra applications can't be created with secrets due to security reasons.
43+
- Microsoft Azure permissions:
44+
- Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role.
45+
46+
2847
## How CCF push works
2948

3049

@@ -507,7 +526,7 @@ Example:
507526

508527

509528

510-
## Building Your First Push Connector - a simple example
529+
## Building Your First Push Connector
511530

512531
In this example, we build a simple push connector that sends security alerts from your application to Sentinel.
513532

@@ -526,17 +545,7 @@ Event structure will be sent by your application:
526545
}
527546
```
528547

529-
### Prerequisites
530-
531-
- Before you begin, you must have access to the Azure-Sentinel GitHub repository for packaging tools.
532-
- Microsoft Entra permissions:
533-
- Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher.
534-
- Permission to create an application with secrets. Note: The connector fails if Entra applications can't be created with secrets due to security reasons.
535-
- Microsoft Azure permissions:
536-
- Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role.
537-
538-
539-
548+
### Step-by-step guide to create the push connector
540549

541550
1. Clone the Azure-Sentinel Repository
542551

@@ -1072,7 +1081,7 @@ Event structure will be sent by your application:
10721081
10731082
**Python Example Application Code:**
10741083
1075-
The following example uses placeholder values like <Your-Tenant-ID>. You must replace these with secure references to your actual credentials.
1084+
The following example uses placeholder values like \<Your-Tenant-ID\>. You must replace these with secure references to your actual credentials.
10761085
10771086
```python
10781087
import requests

0 commit comments

Comments
 (0)