Data Connectors - Connect

Reference

Service:: Sentinel

API Version:: 2024-01-01-preview

Connects a data connector.

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}/connect?api-version=2024-01-01-preview

URI Parameters

Name	In	Required	Type	Description
dataConnectorId	path	True	string	Connector ID
resourceGroupName	path	True	string	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string	The ID of the target subscription.
workspaceName	path	True	string	The name of the workspace. Regex pattern: `^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$`
api-version	query	True	string	The API version to use for this operation.

Request Body

Name	Type	Description
apiKey	string	The API key of the audit server.
authorizationCode	string	The authorization code used in OAuth 2.0 code flow to issue a token.
clientId	string	The client id of the OAuth 2.0 application.
clientSecret	string	The client secret of the OAuth 2.0 application.
dataCollectionEndpoint	string	Used in v2 logs connector. Represents the data collection ingestion endpoint in log analytics.
dataCollectionRuleImmutableId	string	Used in v2 logs connector. The data collection rule immutable id, the rule defines the transformation and data destination.
kind	ConnectAuthKind	The authentication kind used to poll the data
outputStream	string	Used in v2 logs connector. The stream we are sending the data to, this is the name of the streamDeclarations defined in the DCR.
password	string	The user password in the audit log server.
requestConfigUserInputValues	object[]
userName	string	The user name in the audit log server.

Responses

Name	Type	Description
200 OK		OK, Operation successfully completed
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Connect an APIPolling data connector

Connect an APIPolling V2 logs data connector

Connect an APIPolling data connector

POST https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/316ec55e-7138-4d63-ab18-90c8a60fd1c8/connect?api-version=2024-01-01-preview

{
  "kind": "APIKey",
  "apiKey": "123456789",
  "requestConfigUserInputValues": [
    {
      "displayText": "Organization Name",
      "placeHolderName": "{{placeHolder1}}",
      "placeHolderValue": "somePlaceHolderValue",
      "requestObjectKey": "apiEndpoint"
    }
  ]
}

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/ConnectAPIPolling.json
// this example is just showing the usage of "DataConnectors_Connect" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SecurityInsightsDataConnectorResource created on azure
// for more information of creating SecurityInsightsDataConnectorResource, please refer to the document of SecurityInsightsDataConnectorResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
string dataConnectorId = "316ec55e-7138-4d63-ab18-90c8a60fd1c8";
ResourceIdentifier securityInsightsDataConnectorResourceId = SecurityInsightsDataConnectorResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName, dataConnectorId);
SecurityInsightsDataConnectorResource securityInsightsDataConnector = client.GetSecurityInsightsDataConnectorResource(securityInsightsDataConnectorResourceId);

// invoke the operation
DataConnectorConnectContent content = new DataConnectorConnectContent()
{
    Kind = ConnectAuthKind.APIKey,
    ApiKey = "123456789",
    RequestConfigUserInputValues =
    {
    BinaryData.FromObjectAsJson(new Dictionary<string, object>()
    {
    ["displayText"] = "Organization Name",
    ["placeHolderName"] = "{{placeHolder1}}",
    ["placeHolderValue"] = "somePlaceHolderValue",
    ["requestObjectKey"] = "apiEndpoint"})
    },
};
await securityInsightsDataConnector.ConnectAsync(content);

Console.WriteLine($"Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

Connect an APIPolling V2 logs data connector

Sample request

HTTP
dotnet

POST https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/316ec55e-7138-4d63-ab18-90c8a60fd1c8/connect?api-version=2024-01-01-preview

{
  "kind": "APIKey",
  "apiKey": "123456789",
  "dataCollectionEndpoint": "https://test.eastus.ingest.monitor.azure.com",
  "dataCollectionRuleImmutableId": "dcr-34adsj9o7d6f9de204478b9cgb43b631",
  "outputStream": "Custom-MyTableRawData",
  "requestConfigUserInputValues": [
    {
      "displayText": "Organization Name",
      "placeHolderName": "{{placeHolder1}}",
      "placeHolderValue": "somePlaceHolderValue",
      "requestObjectKey": "apiEndpoint"
    }
  ]
}

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/ConnectAPIPollingV2Logs.json
// this example is just showing the usage of "DataConnectors_Connect" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SecurityInsightsDataConnectorResource created on azure
// for more information of creating SecurityInsightsDataConnectorResource, please refer to the document of SecurityInsightsDataConnectorResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
string dataConnectorId = "316ec55e-7138-4d63-ab18-90c8a60fd1c8";
ResourceIdentifier securityInsightsDataConnectorResourceId = SecurityInsightsDataConnectorResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName, dataConnectorId);
SecurityInsightsDataConnectorResource securityInsightsDataConnector = client.GetSecurityInsightsDataConnectorResource(securityInsightsDataConnectorResourceId);

// invoke the operation
DataConnectorConnectContent content = new DataConnectorConnectContent()
{
    Kind = ConnectAuthKind.APIKey,
    ApiKey = "123456789",
    DataCollectionEndpoint = "https://test.eastus.ingest.monitor.azure.com",
    DataCollectionRuleImmutableId = "dcr-34adsj9o7d6f9de204478b9cgb43b631",
    OutputStream = "Custom-MyTableRawData",
    RequestConfigUserInputValues =
    {
    BinaryData.FromObjectAsJson(new Dictionary<string, object>()
    {
    ["displayText"] = "Organization Name",
    ["placeHolderName"] = "{{placeHolder1}}",
    ["placeHolderValue"] = "somePlaceHolderValue",
    ["requestObjectKey"] = "apiEndpoint"})
    },
};
await securityInsightsDataConnector.ConnectAsync(content);

Console.WriteLine($"Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

Definitions

Name	Description
CloudError	Error response structure.
CloudErrorBody	Error details.
ConnectAuthKind	The authentication kind used to poll the data
DataConnectorConnectBody	Represents Codeless API Polling data connector.

CloudError

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

ConnectAuthKind

The authentication kind used to poll the data

Name	Type	Description
APIKey	string
Basic	string
OAuth2	string

DataConnectorConnectBody

Represents Codeless API Polling data connector.

Name	Type	Description
apiKey	string	The API key of the audit server.
authorizationCode	string	The authorization code used in OAuth 2.0 code flow to issue a token.
clientId	string	The client id of the OAuth 2.0 application.
clientSecret	string	The client secret of the OAuth 2.0 application.
dataCollectionEndpoint	string	Used in v2 logs connector. Represents the data collection ingestion endpoint in log analytics.
dataCollectionRuleImmutableId	string	Used in v2 logs connector. The data collection rule immutable id, the rule defines the transformation and data destination.
kind	ConnectAuthKind	The authentication kind used to poll the data
outputStream	string	Used in v2 logs connector. The stream we are sending the data to, this is the name of the streamDeclarations defined in the DCR.
password	string	The user password in the audit log server.
requestConfigUserInputValues	object[]
userName	string	The user name in the audit log server.

Share via

Data Connectors - Connect

URI Parameters

Request Body

Responses

Security

azure_auth

Scopes

Examples

Connect an APIPolling data connector

Sample request

Sample response

Connect an APIPolling V2 logs data connector

Sample request

Sample response

Definitions

CloudError

CloudErrorBody

ConnectAuthKind

DataConnectorConnectBody

Additional resources