MicrosoftDocs · changeworld · Dec 9, 2025
diff --git a/articles/sentinel/includes/deprecated-connectors.md b/articles/sentinel/includes/deprecated-connectors.md
@@ -20,7 +20,7 @@ ms.date: 10/20/2025
 |<a name="deprecated-github-enterprise-audit-log"></a><details><summary>**[Deprecated] GitHub Enterprise Audit Log** &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</summary> <br> The GitHub audit log connector provides the capability to ingest GitHub logs into Microsoft Sentinel. By connecting GitHub audit logs into Microsoft Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process. <br><br> **Note:** If you intended to ingest GitHub subscribed events into Microsoft Sentinel, please refer to GitHub (using Webhooks) Connector from "**Data Connectors**" gallery.<br><br><p>NOTE: This data connector has been deprecated, consider moving to the CCF data connector available in the solution which replaces ingestion via the <a href='/azure/azure-monitor/logs/custom-logs-migrate' >deprecated HTTP Data Collector API</a>.</p><p> **Log Analytics table(s):** <br> - `GitHubAuditLogPolling_CL`<p>**Data collection rule support:** <br>Not currently supported<p>**Prerequisites:**<br> - **GitHub API personal access token**: You need a GitHub personal access token to enable polling for the organization audit log. You may use either a classic token with 'read:org' scope OR a fine-grained token with 'Administration: Read-only' scope.<p> - **GitHub Enterprise type**: This connector will only function with GitHub Enterprise Cloud; it will not support GitHub Enterprise Server. </details> | [Microsoft Corporation](https://azure.microsoft.com/support/options/) | 
 |<a name="deprecated-infoblox-soc-insight-data-connector-via-legacy-agent"></a><details><summary>**[Deprecated] Infoblox SOC Insight Data Connector via Legacy Agent** </summary> <br> The Infoblox SOC Insight Data Connector allows you to easily connect your Infoblox BloxOne SOC Insight data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log. <br><br>This data connector ingests Infoblox SOC Insight CDC logs into your Log Analytics Workspace using the legacy Log Analytics agent.<br><br>**Microsoft recommends installation of Infoblox SOC Insight Data Connector via AMA Connector.** The legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and should only be installed where AMA is not supported.<br><br> Using MMA and AMA on the same machine can cause log duplication and extra ingestion cost. [More details](/azure/sentinel/ama-migrate).<p> **Log Analytics table(s):** <br> - `CommonSecurityLog`<p>**Data collection rule support:** <br>[Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)</details> | [Infoblox](https://support.infoblox.com/) | 
 |<a name="deprecated-lookout"></a><details><summary>**[Deprecated] Lookout** </summary> <br> The [Lookout](https://lookout.com) data connector provides the capability to ingest [Lookout](https://enterprise.support.lookout.com/hc/en-us/articles/115002741773-Mobile-Risk-API-Guide#commoneventfields) events into Microsoft Sentinel through the Mobile Risk API. Refer to [API documentation](https://enterprise.support.lookout.com/hc/en-us/articles/115002741773-Mobile-Risk-API-Guide) for more information. The [Lookout](https://lookout.com) data connector provides ability to get events which helps to examine potential security risks and more.<br><br><p>NOTE: This data connector has been deprecated, consider moving to the CCF data connector available in the solution which replaces ingestion via the <a href='/azure/azure-monitor/logs/custom-logs-migrate' >deprecated HTTP Data Collector API</a>.</p><p> **Log Analytics table(s):** <br> - `Lookout_CL`<p>**Data collection rule support:** <br>Not currently supported<p>**Prerequisites:**<br> - **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. For more information, see [Azure Functions](/azure/azure-functions/).<p> - **Mobile Risk API Credentials/permissions**: **EnterpriseName** & **ApiKey** are required for Mobile Risk API. For more information, see [API](https://enterprise.support.lookout.com/hc/en-us/articles/115002741773-Mobile-Risk-API-Guide). Check all [requirements and follow  the instructions](https://enterprise.support.lookout.com/hc/en-us/articles/115002741773-Mobile-Risk-API-Guide#authenticatingwiththemobileriskapi) for obtaining credentials.</details> | [Lookout](https://www.lookout.com/support) | 
-|<a name="deprecated-microsoft-exchange-logs-and-events"></a><details><summary>**[Deprecated] Microsoft Exchange Logs and Events** </summary> <br> Deprecated, use the 'ESI-Opt' dataconnectors. You can stream all Exchange Audit events, IIS Logs, HTTP Proxy logs and Security Event logs from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This is used by Microsoft Exchange Security Workbooks to provide security insights of your On-Premises Exchange environment<p> **Log Analytics table(s):** <br> - `Event`<br>- `SecurityEvent`<br>- `W3CIISLog`<br>- `MessageTrackingLog_CL`<br>- `ExchangeHttpProxy_CL`<p>**Data collection rule support:** <br>Not currently supported<p>**Prerequisites:**<br> - Azure Log Analytics will be deprecated, to collect data from non-Azure VMs, Azure Arc is recommended. [Learn more](/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)<p> - **Detailled documentation**: >**NOTE:** Detailled documentation on Installation procedure and usage can be found [here](https://aka.ms/MicrosoftExchangeSecurityGithub)</details> | [Community](https://github.com/Azure/Azure-Sentinel/issues) | 
+|<a name="deprecated-microsoft-exchange-logs-and-events"></a><details><summary>**[Deprecated] Microsoft Exchange Logs and Events** </summary> <br> Deprecated, use the 'ESI-Opt' dataconnectors. You can stream all Exchange Audit events, IIS Logs, HTTP Proxy logs and Security Event logs from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This is used by Microsoft Exchange Security Workbooks to provide security insights of your On-Premises Exchange environment<p> **Log Analytics table(s):** <br> - `Event`<br>- `SecurityEvent`<br>- `W3CIISLog`<br>- `MessageTrackingLog_CL`<br>- `ExchangeHttpProxy_CL`<p>**Data collection rule support:** <br>Not currently supported<p>**Prerequisites:**<br> - Azure Log Analytics will be deprecated, to collect data from non-Azure VMs, Azure Arc is recommended. [Learn more](/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)<p> - **Detailed documentation**: >**NOTE:** Detailed documentation on Installation procedure and usage can be found [here](https://aka.ms/MicrosoftExchangeSecurityGithub)</details> | [Community](https://github.com/Azure/Azure-Sentinel/issues) | 
 |<a name="security-events-via-legacy-agent"></a><details><summary>**Security Events via Legacy Agent** </summary> <br> You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220093&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).<p> **Log Analytics table(s):** <br> - `SecurityEvent`<p>**Data collection rule support:** <br>Not currently supported</details> | [Microsoft Corporation](https://support.microsoft.com/) | 
 |<a name="subscription-based-microsoft-defender-for-cloud-legacy"></a><details><summary>**Subscription-based Microsoft Defender for Cloud (Legacy)** </summary> <br> Microsoft Defender for Cloud is a security management tool that allows you to detect and quickly respond to threats across Azure, hybrid, and multi-cloud workloads. This connector allows you to stream your security alerts from Microsoft Defender for Cloud into Microsoft Sentinel, so you can view Defender data in workbooks, query it to produce alerts, and investigate and respond to incidents.<br><br>[For more information>](https://aka.ms/ASC-Connector)<p> **Log Analytics table(s):** <br> - `SecurityAlert`<p>**Data collection rule support:** <br>Not currently supported</details> | [Microsoft Corporation](https://support.microsoft.com/) | 
 |<a name="syslog-via-legacy-agent"></a><details><summary>**Syslog via Legacy Agent** </summary> <br> Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to the workspace.<br><br>[Learn more >](https://aka.ms/sysLogInfo)<p> **Log Analytics table(s):** <br> - `Syslog`<p>**Data collection rule support:** <br>[Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)</details> | [Microsoft Corporation](https://support.microsoft.com/) |