Understanding connectors
Azure Sentinel relies on Log Analytics to store large volumes of data, in order to process that data and find useful information about potential risks and security threats. The data required may be located in many different types of resources across many different platforms, which is why we need many different options for connecting to those data sources. Understanding the options available, and how to configure them, is key to developing a strong data architecture to support the Azure Sentinel solution.
A summary of the connectors is shown in the following screenshot:
Figure 3.3 – Azure Sentinel connector flow
Connectors can be categorized based on the method used to ingest data from source. Currently, there are four main types:
- Native connections
- Direct connections
- API connections
- Agent-based (Windows Server Agent and Syslog)
Let's explore each of these types in more detail.
