Skip to content

Commit 8162b15

Browse files
v-aljev-alje
committed
[AUTOGEN] PR for Sentinel connectors
1 parent f41067c commit 8162b15

2 files changed

Lines changed: 69 additions & 22 deletions

File tree

‎articles/sentinel/includes/connector-details.md‎

Lines changed: 61 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
author: EdB-MSFT
33
ms.author: edbaynash
44
ms.topic: include
5-
ms.date: 02/09/2026
5+
ms.date: 02/23/2026
66

77
# This file is auto-generated . Do not edit manually. Changes will be overwritten.
88
---
@@ -631,7 +631,7 @@ The Azure DevOps Audit Logs data connector allows you to ingest audit events fro
631631

632632
**Prerequisites:**
633633

634-
- **Azure DevOps Prerequisite**: Please ensure the following:<br> 1. Register an Entra App in Microsoft Entra Admin Center under App Registrations.<br> 2. In 'API permissions' - add Permissions to 'Azure DevOps - vso.auditlog'.<br> 3. In 'Certificates & secrets' - generate 'Client secret'.<br> 4. In 'Authentication' - add Redirect URI: 'https://portal.azure.com/TokenAuthorize/ExtensionName/Microsoft_Azure_Security_Insights'.<br> 5. In the Azure DevOps settings - enable audit log and set **View audit log** for the user. [Azure DevOps Auditing](/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page).<br> 6. Ensure the user assigned to connect the data connector has the View audit logs permission explicitly set to Allow at all times. This permission is essential for successful log ingestion. If the permission is revoked or not granted, data ingestion will fail or be interrupted.<br><br>
634+
- **Azure DevOps Prerequisite**: Please ensure the following:<br> 1. Register an Entra App in Microsoft Entra Admin Center under App Registrations.<br> 2. In 'API permissions' - add Permissions to 'Azure DevOps - vso.auditlog'.<br> 3. In 'Certificates & secrets' - generate 'Client secret'.<br> 4. In 'Authentication' - add the Redirect URI found below in the corresponding field.<br> 5. In the Azure DevOps settings - enable audit log and set **View audit log** for the user. [Azure DevOps Auditing](/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page).<br> 6. Ensure the user assigned to connect the data connector has the View audit logs permission explicitly set to Allow at all times. This permission is essential for successful log ingestion. If the permission is revoked or not granted, data ingestion will fail or be interrupted.<br><br>
635635
</details>
636636

637637
---
@@ -880,6 +880,27 @@ The BETTER MTD Connector allows Enterprises to connect their Better MTD instance
880880

881881
---
882882

883+
<a name="bigid-dspm-connector"></a><details><summary>**BigID DSPM connector**</summary>
884+
885+
**Supported by:** [BigID](https://support.bigid.com/)
886+
887+
The [BigID DSPM](https://bigid.com/data-security-posture-management/) data connector provides the capability to ingest BigID DSPM cases with affected objects and datasource information into Microsoft Sentinel.
888+
889+
**Log Analytics table(s):**
890+
891+
|Table|DCR support|Lake-only ingestion|
892+
|---|---|---|
893+
|`BigIDDSPMCatalog_CL`|Yes|Yes|
894+
895+
**Data collection rule support:** [Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)
896+
897+
**Prerequisites:**
898+
899+
- **BigID DSPM API access**: Access to the BigID DSPM API through a BigID Token is required.<br><br>
900+
</details>
901+
902+
---
903+
883904
<a name="bitglass-using-azure-functions"></a><details><summary>**Bitglass (using Azure Functions)**</summary>
884905

885906
**Supported by:** [Microsoft Corporation](https://support.microsoft.com/)
@@ -1096,8 +1117,8 @@ The Cisco Cloud Security solution for Microsoft Sentinel enables you to ingest [
10961117
|`Cisco_Umbrella_dns_CL`|Yes|Yes|
10971118
|`Cisco_Umbrella_proxy_CL`|Yes|Yes|
10981119
|`Cisco_Umbrella_ip_CL`|Yes|Yes|
1099-
|`Cisco_Umbrella_cloudfirewall_CL`|Yes|Yes|
1100-
|`Cisco_Umbrella_firewall_CL`|Yes|Yes|
1120+
|`Cisco_Umbrella_cloudfirewall_CL`|No|No|
1121+
|`Cisco_Umbrella_firewall_CL`|No|No|
11011122
|`Cisco_Umbrella_dlp_CL`|No|No|
11021123
|`Cisco_Umbrella_ravpnlogs_CL`|No|No|
11031124
|`Cisco_Umbrella_audit_CL`|No|No|
@@ -1131,8 +1152,8 @@ The Cisco Umbrella data connector provides the capability to ingest [Cisco Umbre
11311152
|`Cisco_Umbrella_dns_CL`|Yes|Yes|
11321153
|`Cisco_Umbrella_proxy_CL`|Yes|Yes|
11331154
|`Cisco_Umbrella_ip_CL`|Yes|Yes|
1134-
|`Cisco_Umbrella_cloudfirewall_CL`|Yes|Yes|
1135-
|`Cisco_Umbrella_firewall_CL`|Yes|Yes|
1155+
|`Cisco_Umbrella_cloudfirewall_CL`|No|No|
1156+
|`Cisco_Umbrella_firewall_CL`|No|No|
11361157
|`Cisco_Umbrella_dlp_CL`|No|No|
11371158
|`Cisco_Umbrella_ravpnlogs_CL`|No|No|
11381159
|`Cisco_Umbrella_audit_CL`|No|No|
@@ -1344,7 +1365,7 @@ The Cohesity function apps provide the ability to ingest Cohesity Datahawk ranso
13441365

13451366
<a name="commvaultsecurityiq"></a><details><summary>**CommvaultSecurityIQ**</summary>
13461367

1347-
**Supported by:** [Commvault](https://ma.commvault.com/)
1368+
**Supported by:** [Commvault](https://www.commvault.com/support)
13481369

13491370
This Azure Function enables Commvault users to ingest alerts/events into their Microsoft Sentinel instance. With Analytic Rules,Microsoft Sentinel can automatically create Microsoft Sentinel incidents from incoming events and logs.
13501371

@@ -2370,23 +2391,25 @@ This connector allows you to ingest IoCs from Feedly.
23702391

23712392
---
23722393

2373-
<a name="flare"></a><details><summary>**Flare**</summary>
2394+
<a name="flare-push-connector"></a><details><summary>**Flare Push Connector**</summary>
23742395

23752396
**Supported by:** [Flare](https://flare.io/contact/)
23762397

2377-
[Flare](https://flare.systems/platform/) connector allows you to receive data and intelligence from Flare on Microsoft Sentinel.
2398+
The [Flare](https://flare.io) connector provides the capability to ingest threat intelligence and exposure data from Flare into Microsoft Sentinel. Flare identifies your company's digital assets made publicly available due to human error or malicious attacks, including leaked credentials, exposed cloud buckets, darkweb mentions, and more.
23782399

23792400
**Log Analytics table(s):**
23802401

23812402
|Table|DCR support|Lake-only ingestion|
23822403
|---|---|---|
2383-
|`Firework_CL`|No|No|
2404+
|`FireworkV2_CL`|No|No|
23842405

23852406
**Data collection rule support:** Not currently supported
23862407

23872408
**Prerequisites:**
23882409

2389-
- **Required Flare permissions**: Only Flare organization administrators may configure the Microsoft Sentinel integration.<br><br>
2410+
- **Microsoft Entra**: Permission to create an app registration in Microsoft Entra ID.
2411+
- **Microsoft Azure**: Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR).
2412+
- **Flare**: Permission to configure Microsoft Sentinel integration in Flare.<br><br>
23902413
</details>
23912414

23922415
---
@@ -3250,6 +3273,29 @@ The [Jamf Protect](https://www.jamf.com/products/jamf-protect/) connector provid
32503273

32513274
---
32523275

3276+
<a name="joesandboxthreatintelligence-using-azure-functions"></a><details><summary>**JoeSandboxThreatIntelligence (using Azure Functions)**</summary>
3277+
3278+
**Supported by:** [Stefan Bühlmann](https://www.joesecurity.org/support)
3279+
3280+
JoeSandboxThreatIntelligence connector automatically generates and feeds threat intelligence for all submissions to JoeSandbox, improving threat detection and incident response in Sentinel. This seamless integration empowers teams to proactively address emerging threats.
3281+
3282+
**Log Analytics table(s):**
3283+
3284+
|Table|DCR support|Lake-only ingestion|
3285+
|---|---|---|
3286+
|[`ThreatIntelligenceIndicator`](/azure/azure-monitor/reference/tables/ThreatIntelligenceIndicator)|Yes|No|
3287+
3288+
**Data collection rule support:** [Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)
3289+
3290+
**Prerequisites:**
3291+
3292+
- **Azure Subscription**: Azure Subscription with owner role is required to register an application in azure active directory() and assign role of contributor to app in resource group.
3293+
- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. For more information, see [Azure Functions](/azure/azure-functions/).
3294+
- **REST API Credentials/permissions**: **JoeSandbox API Key** is required.<br><br>
3295+
</details>
3296+
3297+
---
3298+
32533299
<a name="keeper-security-push-connector"></a><details><summary>**Keeper Security Push Connector**</summary>
32543300

32553301
**Supported by:** [Keeper Security](https://www.keepersecurity.com/support.html)
@@ -3343,9 +3389,9 @@ MailGuard 365 Enhanced Email Security for Microsoft 365. Exclusive to the Micros
33433389

33443390
|Table|DCR support|Lake-only ingestion|
33453391
|---|---|---|
3346-
|`MailGuard365_Threats_CL`|No|No|
3392+
|`MailGuard365_Threats_CL`|Yes|Yes|
33473393

3348-
**Data collection rule support:** Not currently supported<br><br>
3394+
**Data collection rule support:** [Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)<br><br>
33493395
</details>
33503396

33513397
---
@@ -4250,9 +4296,9 @@ The [MongoDBAtlas](https://www.mongodb.com/products/platform/atlas-database) Log
42504296

42514297
|Table|DCR support|Lake-only ingestion|
42524298
|---|---|---|
4253-
|`MDBALogTable_CL`|No|No|
4299+
|`MDBALogTable_CL`|Yes|Yes|
42544300

4255-
**Data collection rule support:** Not currently supported
4301+
**Data collection rule support:** [Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)
42564302

42574303
**Prerequisites:**
42584304

0 commit comments

Comments
 (0)