Set-XdrSentinelConnection
SYNOPSIS
Configures the Sentinel (Log Analytics) workspace connection for data export.
SYNTAX
Set-XdrSentinelConnection [-WorkspaceId] <String> [-SharedKey] <String> [[-DceEndpoint] <String>]
[-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]
DESCRIPTION
Stores the Log Analytics workspace ID and shared key in script-scoped variables used by Export-XdrToSentinel and Invoke-XdrDefenderHarvest.
The shared key can be found in the Azure portal under: Log Analytics workspace > Agents > Log Analytics agent instructions > Primary/Secondary key
EXAMPLES
EXAMPLE 1
Set-XdrSentinelConnection -WorkspaceId "12345678-abcd-1234-abcd-123456789012" -SharedKey "base64key=="
EXAMPLE 2
$key = Read-Host -AsSecureString "Shared Key"
Set-XdrSentinelConnection -WorkspaceId "12345678-abcd-1234-abcd-123456789012" -SharedKey ([System.Net.NetworkCredential]::new('', $key).Password)
PARAMETERS
-WorkspaceId
The Log Analytics workspace ID (GUID).
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-SharedKey
The primary or secondary shared key for the workspace.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-DceEndpoint
Optional Data Collection Endpoint URI. When set, uses the DCR/DCE ingestion API instead of the legacy HTTP Data Collector API. Not required for most use cases.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-WhatIf
Shows what would happen if the command runs without updating the module's Sentinel connection settings.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Confirm
Prompts for confirmation before updating the module's Sentinel connection settings.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.