The azure-native:securityinsights:RestApiPollerDataConnector resource, part of the Pulumi Azure Native provider, registers REST API poller data connectors that define how Microsoft Sentinel ingests data from external REST APIs. This guide focuses on one capability: data connector registration in Sentinel workspaces.
Data connectors belong to Microsoft Sentinel workspaces and reference connector definition resources that specify API polling behavior, authentication, and data transformation. The examples are intentionally small. Combine them with your own connector definitions, authentication configuration, and data routing rules.
Register a data connector in a Sentinel workspace
Security teams integrate external data sources into Microsoft Sentinel by registering data connectors that define how to poll REST APIs and ingest the results.
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";
const restApiPollerDataConnector = new azure_native.securityinsights.RestApiPollerDataConnector("restApiPollerDataConnector", {
dataConnectorId: "c345bf40-8509-4ed2-b947-50cb773aaf04",
resourceGroupName: "myRg",
workspaceName: "myWorkspace",
});
import pulumi
import pulumi_azure_native as azure_native
rest_api_poller_data_connector = azure_native.securityinsights.RestApiPollerDataConnector("restApiPollerDataConnector",
data_connector_id="c345bf40-8509-4ed2-b947-50cb773aaf04",
resource_group_name="myRg",
workspace_name="myWorkspace")
package main
import (
securityinsights "github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := securityinsights.NewRestApiPollerDataConnector(ctx, "restApiPollerDataConnector", &securityinsights.RestApiPollerDataConnectorArgs{
DataConnectorId: pulumi.String("c345bf40-8509-4ed2-b947-50cb773aaf04"),
ResourceGroupName: pulumi.String("myRg"),
WorkspaceName: pulumi.String("myWorkspace"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var restApiPollerDataConnector = new AzureNative.SecurityInsights.RestApiPollerDataConnector("restApiPollerDataConnector", new()
{
DataConnectorId = "c345bf40-8509-4ed2-b947-50cb773aaf04",
ResourceGroupName = "myRg",
WorkspaceName = "myWorkspace",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.RestApiPollerDataConnector;
import com.pulumi.azurenative.securityinsights.RestApiPollerDataConnectorArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var restApiPollerDataConnector = new RestApiPollerDataConnector("restApiPollerDataConnector", RestApiPollerDataConnectorArgs.builder()
.dataConnectorId("c345bf40-8509-4ed2-b947-50cb773aaf04")
.resourceGroupName("myRg")
.workspaceName("myWorkspace")
.build());
}
}
resources:
restApiPollerDataConnector:
type: azure-native:securityinsights:RestApiPollerDataConnector
properties:
dataConnectorId: c345bf40-8509-4ed2-b947-50cb773aaf04
resourceGroupName: myRg
workspaceName: myWorkspace
The dataConnectorId provides a unique identifier for this connector instance. The resourceGroupName and workspaceName specify where the connector is registered. This minimal configuration relies on a pre-configured connector definition (referenced via connectorDefinitionName, not shown here) that specifies the REST API endpoint, authentication method, request format, and response parsing rules.
Beyond these examples
These snippets focus on data connector registration. They’re intentionally minimal rather than full data ingestion pipelines.
The examples reference pre-existing infrastructure such as Microsoft Sentinel workspaces, resource groups, and connector definition resources. They focus on registering the connector rather than configuring the underlying API polling behavior.
To keep things focused, common data connector patterns are omitted, including:
- Authentication configuration (auth property)
- REST API request and response mapping (request, response properties)
- Data routing and transformation (dataType, dcrConfig)
- Pagination handling for large result sets (paging property)
These omissions are intentional: the goal is to illustrate how data connectors are registered, not provide drop-in ingestion modules. See the RestApiPollerDataConnector resource reference for all available configuration options.
Let's configure Azure Sentinel REST API Poller Data Connectors
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Configuration & Setup
auth (authentication model), connectorDefinitionName (connector definition resource ID), kind (must be ‘RestApiPoller’), and request (request configuration object).dataConnectorId, resourceGroupName, and workspaceName. Additional required properties like auth, request, and connectorDefinitionName may have defaults or be configured through the connector definition resource.isActive property to true or false to control the connector’s active state.Immutability & Lifecycle
dataConnectorId, resourceGroupName, and workspaceName. Changing any of these requires replacing the resource.Import & Management
Use the import command with the full resource path:
pulumi import azure-native:securityinsights:RestApiPollerDataConnector <name> /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}