Third-party (non-Microsoft) data connectors are configured in Microsoft Sentinel for non-Microsoft workloads in scope

Overview

Most enterprise estates run workloads outside Microsoft control planes — AWS accounts, Google Cloud projects, on-premises Linux/Windows servers emitting Syslog/CEF, third-party identity providers (Okta), endpoint security stacks (CrowdStrike, SentinelOne), email security gateways (Proofpoint, Mimecast), network appliances (Palo Alto Networks, Fortinet, Cisco ASA/FTD), CASBs, and SaaS audit logs. When these sources are not connected to Sentinel, the SIEM has a one-sided view of the kill chain: Sentinel can detect a Microsoft Entra sign-in but cannot see the preceding AWS IAM CreateAccessKey, the on-premises Linux SSH brute force, the perimeter firewall command-and-control beacon, or the third-party EDR malware detonation that precedes lateral movement. Threat actors operate end-to-end across Microsoft and non-Microsoft surfaces, and a SIEM that ignores the non-Microsoft surface produces detection-blind windows large enough for a full intrusion lifecycle to complete. Sentinel exposes built-in third-party connectors (AmazonWebServicesS3, GCP, Syslog/CEF, Okta SSO, codeless connectors for SaaS APIs) precisely so the SIEM can correlate identity, endpoint, network, and cloud events across the customer’s full estate.

Remediation

• Connect AWS to Microsoft Sentinel
• Connect GCP to Microsoft Sentinel
• Collect Syslog/CEF logs
• Find your Microsoft Sentinel data connector

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Security information and event management
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
Licence	Consumption-based: Microsoft Sentinel
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.