The azure-native:securityinsights:RestApiPollerDataConnector resource, part of the Pulumi Azure Native provider, registers REST API poller data connectors that define how Microsoft Sentinel ingests data from external REST APIs. This guide focuses on one capability: data connector registration in Sentinel workspaces.
Data connectors belong to Microsoft Sentinel workspaces and reference connector definition resources that specify API polling behavior, authentication, and data transformation. The examples are intentionally small. Combine them with your own connector definitions, authentication configuration, and data routing rules.
Register a data connector in a Sentinel workspace
Security teams integrate external data sources into Microsoft Sentinel by registering data connectors that define how to poll REST APIs and ingest the results.
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";
const restApiPollerDataConnector = new azure_native.securityinsights.RestApiPollerDataConnector("restApiPollerDataConnector", {
dataConnectorId: "c345bf40-8509-4ed2-b947-50cb773aaf04",
resourceGroupName: "myRg",
workspaceName: "myWorkspace",
});
import pulumi
import pulumi_azure_native as azure_native
rest_api_poller_data_connector = azure_native.securityinsights.RestApiPollerDataConnector("restApiPollerDataConnector",
data_connector_id="c345bf40-8509-4ed2-b947-50cb773aaf04",
resource_group_name="myRg",
workspace_name="myWorkspace")
package main
import (
securityinsights "github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := securityinsights.NewRestApiPollerDataConnector(ctx, "restApiPollerDataConnector", &securityinsights.RestApiPollerDataConnectorArgs{
DataConnectorId: pulumi.String("c345bf40-8509-4ed2-b947-50cb773aaf04"),
ResourceGroupName: pulumi.String("myRg"),
WorkspaceName: pulumi.String("myWorkspace"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var restApiPollerDataConnector = new AzureNative.SecurityInsights.RestApiPollerDataConnector("restApiPollerDataConnector", new()
{
DataConnectorId = "c345bf40-8509-4ed2-b947-50cb773aaf04",
ResourceGroupName = "myRg",
WorkspaceName = "myWorkspace",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.RestApiPollerDataConnector;
import com.pulumi.azurenative.securityinsights.RestApiPollerDataConnectorArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var restApiPollerDataConnector = new RestApiPollerDataConnector("restApiPollerDataConnector", RestApiPollerDataConnectorArgs.builder()
.dataConnectorId("c345bf40-8509-4ed2-b947-50cb773aaf04")
.resourceGroupName("myRg")
.workspaceName("myWorkspace")
.build());
}
}
resources:
restApiPollerDataConnector:
type: azure-native:securityinsights:RestApiPollerDataConnector
properties:
dataConnectorId: c345bf40-8509-4ed2-b947-50cb773aaf04
resourceGroupName: myRg
workspaceName: myWorkspace
The dataConnectorId provides a unique identifier for this connector instance. The resourceGroupName and workspaceName specify where the connector is registered. This minimal configuration relies on a pre-configured connector definition (referenced via connectorDefinitionName, not shown here) that specifies the REST API endpoint, authentication method, request format, and response parsing rules.
Beyond these examples
These snippets focus on data connector registration. They’re intentionally minimal rather than full data ingestion pipelines.
The examples reference pre-existing infrastructure such as Microsoft Sentinel workspaces, resource groups, and connector definition resources. They focus on registering the connector rather than configuring the underlying API polling behavior.
To keep things focused, common data connector patterns are omitted, including:
- Authentication configuration (auth property)
- REST API request and response mapping (request, response properties)
- Data routing and transformation (dataType, dcrConfig)
- Pagination handling for large result sets (paging property)
These omissions are intentional: the goal is to illustrate how data connectors are registered, not provide drop-in ingestion modules. See the RestApiPollerDataConnector resource reference for all available configuration options.
Let's configure Azure Sentinel REST API Poller Data Connectors
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Configuration & Setup
auth (authentication model), connectorDefinitionName (the dataConnectorDefinition resource id), request (request configuration), and kind (which must be set to RestApiPoller).kind property must be set to RestApiPoller for this resource type.Immutability & Lifecycle
dataConnectorId, resourceGroupName, and workspaceName. Changing any of these requires replacing the resource./subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}Data Collection & Routing
isActive (whether the connector is active), dataType (Log Analytics table destination), dcrConfig (Data Collection Rule properties), paging (paging configuration), response (response configuration), and addOnAttributes (additional attributes to include in the payload).