Data Connectors - Create Or Update

Creates or updates the data connector.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}?api-version=2020-01-01

URI Parameters

Name In Required Type Description
dataConnectorId
path True
  • string

Connector ID

resourceGroupName
path True
  • string

The name of the resource group within the user's subscription. The name is case insensitive.

Regex pattern: ^[-\w\._\(\)]+$

subscriptionId
path True
  • string

Azure subscription ID

Regex pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$

workspaceName
path True
  • string

The name of the workspace.

api-version
query True
  • string

API version for the operation

Request Body

The request body can be one of the following:

Name Description
AADDataConnector

Represents AAD (Azure Active Directory) data connector.

AATPDataConnector

Represents AATP (Azure Advanced Threat Protection) data connector.

ASCDataConnector

Represents ASC (Azure Security Center) data connector.

AwsCloudTrailDataConnector

Represents Amazon Web Services CloudTrail data connector.

MCASDataConnector

Represents MCAS (Microsoft Cloud App Security) data connector.

MDATPDataConnector

Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.

OfficeDataConnector

Represents office data connector.

TIDataConnector

Represents threat intelligence data connector.

AADDataConnector

Represents AAD (Azure Active Directory) data connector.

Name Required Type Description
kind True string:
  • AzureActiveDirectory

The data connector kind

etag
  • string

Etag of the azure resource

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

AATPDataConnector

Represents AATP (Azure Advanced Threat Protection) data connector.

Name Required Type Description
kind True string:
  • AzureAdvancedThreatProtection

The data connector kind

etag
  • string

Etag of the azure resource

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

ASCDataConnector

Represents ASC (Azure Security Center) data connector.

Name Required Type Description
kind True string:
  • AzureSecurityCenter

The data connector kind

etag
  • string

Etag of the azure resource

properties.dataTypes

The available data types for the connector.

properties.subscriptionId
  • string

The subscription id to connect to, and get the data from.

AwsCloudTrailDataConnector

Represents Amazon Web Services CloudTrail data connector.

Name Required Type Description
kind True string:
  • AmazonWebServicesCloudTrail

The data connector kind

etag
  • string

Etag of the azure resource

properties.awsRoleArn
  • string

The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account.

properties.dataTypes

The available data types for the connector.

MCASDataConnector

Represents MCAS (Microsoft Cloud App Security) data connector.

Name Required Type Description
kind True string:
  • MicrosoftCloudAppSecurity

The data connector kind

etag
  • string

Etag of the azure resource

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

MDATPDataConnector

Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.

Name Required Type Description
kind True string:
  • MicrosoftDefenderAdvancedThreatProtection

The data connector kind

etag
  • string

Etag of the azure resource

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

OfficeDataConnector

Represents office data connector.

Name Required Type Description
kind True string:
  • Office365

The data connector kind

etag
  • string

Etag of the azure resource

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

TIDataConnector

Represents threat intelligence data connector.

Name Required Type Description
kind True string:
  • ThreatIntelligence

The data connector kind

etag
  • string

Etag of the azure resource

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

Responses

Name Type Description
200 OK DataConnector:

OK, Operation successfully completed

201 Created DataConnector:

Created

Other Status Codes

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Creates or updates an Office365 data connector.

Sample Request

PUT https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5?api-version=2020-01-01
{
  "kind": "Office365",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "sharePoint": {
        "state": "Enabled"
      },
      "exchange": {
        "state": "Enabled"
      },
      "teams": {
        "state": "Enabled"
      }
    }
  }
}

Sample Response

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "Office365",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "sharePoint": {
        "state": "Enabled"
      },
      "exchange": {
        "state": "Enabled"
      },
      "teams": {
        "state": "Enabled"
      }
    }
  }
}
{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "Office365",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "sharePoint": {
        "state": "Enabled"
      },
      "exchange": {
        "state": "Enabled"
      },
      "teams": {
        "state": "Enabled"
      }
    }
  }
}

Definitions

AADDataConnector

Represents AAD (Azure Active Directory) data connector.

AATPDataConnector

Represents AATP (Azure Advanced Threat Protection) data connector.

AlertsDataTypeOfDataConnector

Alerts data type for data connectors.

ASCDataConnector

Represents ASC (Azure Security Center) data connector.

AwsCloudTrailDataConnector

Represents Amazon Web Services CloudTrail data connector.

AwsCloudTrailDataConnectorDataTypes

The available data types for Amazon Web Services CloudTrail data connector.

CloudError

An error response for a resource management request.

DataConnectorDataTypeCommon

Common field for data type in data connectors.

DataConnectorKind

The kind of the data connector

DataTypeState

Describe whether this data type connection is enabled or not.

ErrorAdditionalInfo

The resource management error additional info.

ErrorResponse

Error Response

Exchange

Exchange data type connection.

Indicators

Data type for indicators connection.

Logs

Logs data type.

MCASDataConnector

Represents MCAS (Microsoft Cloud App Security) data connector.

MCASDataConnectorDataTypes

The available data types for MCAS (Microsoft Cloud App Security) data connector.

MDATPDataConnector

Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.

OfficeDataConnector

Represents office data connector.

OfficeDataConnectorDataTypes

The available data types for office data connector.

SharePoint

SharePoint data type connection.

Teams

Teams data type connection.

TIDataConnector

Represents threat intelligence data connector.

TIDataConnectorDataTypes

The available data types for TI (Threat Intelligence) data connector.

AADDataConnector

Represents AAD (Azure Active Directory) data connector.

Name Type Description
etag
  • string

Etag of the azure resource

id
  • string

Azure resource Id

kind string:
  • AzureActiveDirectory

The data connector kind

name
  • string

Azure resource name

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

type
  • string

Azure resource type

AATPDataConnector

Represents AATP (Azure Advanced Threat Protection) data connector.

Name Type Description
etag
  • string

Etag of the azure resource

id
  • string

Azure resource Id

kind string:
  • AzureAdvancedThreatProtection

The data connector kind

name
  • string

Azure resource name

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

type
  • string

Azure resource type

AlertsDataTypeOfDataConnector

Alerts data type for data connectors.

Name Type Description
alerts

Alerts data type connection.

ASCDataConnector

Represents ASC (Azure Security Center) data connector.

Name Type Description
etag
  • string

Etag of the azure resource

id
  • string

Azure resource Id

kind string:
  • AzureSecurityCenter

The data connector kind

name
  • string

Azure resource name

properties.dataTypes

The available data types for the connector.

properties.subscriptionId
  • string

The subscription id to connect to, and get the data from.

type
  • string

Azure resource type

AwsCloudTrailDataConnector

Represents Amazon Web Services CloudTrail data connector.

Name Type Description
etag
  • string

Etag of the azure resource

id
  • string

Azure resource Id

kind string:
  • AmazonWebServicesCloudTrail

The data connector kind

name
  • string

Azure resource name

properties.awsRoleArn
  • string

The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account.

properties.dataTypes

The available data types for the connector.

type
  • string

Azure resource type

AwsCloudTrailDataConnectorDataTypes

The available data types for Amazon Web Services CloudTrail data connector.

Name Type Description
logs

Logs data type.

CloudError

An error response for a resource management request.

Name Type Description
error

Error Response
The error object of the CloudError response

DataConnectorDataTypeCommon

Common field for data type in data connectors.

Name Type Description
state

Describe whether this data type connection is enabled or not.

DataConnectorKind

The kind of the data connector

Name Type Description
AmazonWebServicesCloudTrail
  • string
AzureActiveDirectory
  • string
AzureAdvancedThreatProtection
  • string
AzureSecurityCenter
  • string
MicrosoftCloudAppSecurity
  • string
MicrosoftDefenderAdvancedThreatProtection
  • string
Office365
  • string
ThreatIntelligence
  • string

DataTypeState

Describe whether this data type connection is enabled or not.

Name Type Description
Disabled
  • string
Enabled
  • string

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info
  • object

The additional info.

type
  • string

The additional info type.

ErrorResponse

Error Response

Name Type Description
additionalInfo

The error additional info.

code
  • string

The error code.

details

The error details.

message
  • string

The error message.

target
  • string

The error target.

Exchange

Exchange data type connection.

Name Type Description
state

Describe whether this data type connection is enabled or not.

Indicators

Data type for indicators connection.

Name Type Description
state

Describe whether this data type connection is enabled or not.

Logs

Logs data type.

Name Type Description
state

Describe whether this data type connection is enabled or not.

MCASDataConnector

Represents MCAS (Microsoft Cloud App Security) data connector.

Name Type Description
etag
  • string

Etag of the azure resource

id
  • string

Azure resource Id

kind string:
  • MicrosoftCloudAppSecurity

The data connector kind

name
  • string

Azure resource name

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

type
  • string

Azure resource type

MCASDataConnectorDataTypes

The available data types for MCAS (Microsoft Cloud App Security) data connector.

Name Type Description
alerts

Alerts data type connection.

discoveryLogs

Discovery log data type connection.

MDATPDataConnector

Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.

Name Type Description
etag
  • string

Etag of the azure resource

id
  • string

Azure resource Id

kind string:
  • MicrosoftDefenderAdvancedThreatProtection

The data connector kind

name
  • string

Azure resource name

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

type
  • string

Azure resource type

OfficeDataConnector

Represents office data connector.

Name Type Description
etag
  • string

Etag of the azure resource

id
  • string

Azure resource Id

kind string:
  • Office365

The data connector kind

name
  • string

Azure resource name

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

type
  • string

Azure resource type

OfficeDataConnectorDataTypes

The available data types for office data connector.

Name Type Description
exchange

Exchange data type connection.

sharePoint

SharePoint data type connection.

teams

Teams data type connection.

SharePoint

SharePoint data type connection.

Name Type Description
state

Describe whether this data type connection is enabled or not.

Teams

Teams data type connection.

Name Type Description
state

Describe whether this data type connection is enabled or not.

TIDataConnector

Represents threat intelligence data connector.

Name Type Description
etag
  • string

Etag of the azure resource

id
  • string

Azure resource Id

kind string:
  • ThreatIntelligence

The data connector kind

name
  • string

Azure resource name

properties.dataTypes

The available data types for the connector.

properties.tenantId
  • string

The tenant id to connect to, and get the data from.

type
  • string

Azure resource type

TIDataConnectorDataTypes

The available data types for TI (Threat Intelligence) data connector.

Name Type Description
indicators

Data type for indicators connection.