Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Build custom connectors with AI in Microsoft Sentinel

4 September 2026Doc update+39 / −29 lines

In brief

The article now uses clearer titles and headings, adds setup and validation guidance, clarifies the AI-assisted Visual Studio Code workflow, and updates screenshots and metadata.

What Defender admins need to know

Administrators and connector developers can follow the revised process more easily when creating, refining, and validating custom Sentinel connectors.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Get started withBuild custom connectors usingwith AI agent in Microsoft Sentinel

The Microsoft Sentinel connector builder agent builds data connectors in minutes using the AI‑assisted workflow in GitHub Copilot using the Microsoft Sentinel extension for Visual Studio Code (VS Code). with GitHub Copilot. This low‑code experience guides developers and Independent Software Vendors (ISVs) end‑to‑end by autonomously generating schemas, deployment assets, connector UI, secure secret handling, and polling logic. Built‑in validation surfaces any polling issues early, so you can validate event logs before deploying and ingesting data.

The Sentinel Connectorconnector builder agent helps you:

  • Reduce manual time and effort in authoring Codeless Connector Framework (CCF)–based connectors

  • Microsoft Sentinel Contributor role to create or modify Sentinel data connectors

  • Claude Sonnet 4.5 or later

Benefits of Connectorsconnectors with Agenticagentic experience

The Sentinel Connectorconnector builder agent can reduce connector development time from weeks to hours for many common scenarios. Tasks that previously required multiple tools, manual handoffs, and repeated validation cycles can now be completed inline, enabling faster iteration and quicker readiness for deployment.

Area Non-AI connector development process VS Code extension with Connector Builder Agent

Create a custom connector using Sentinel connector builder agent

The following steps show how to create, validate, and deploy a custom Microsoft Sentinel connector using the Sentinel Connector Builderconnector builder agent in VS Code.

Step 1: Install and open the Sentinel extension for VS Code

To set up your development environment, follow these steps:

  1. Install Microsoft Sentinel extension for Visual Studio Code and reload VS Code if prompted.

  2. Create and open an empty folder in File explorer. All agent-generated files are locally saved in this folder.

Step 2: Prompt the Sentinel Connectorconnector builder agent

To create a connector with the agent, follow these steps:

  1. Open the VS Code chat and set the chat to Agent mode.

    For example, enter the prompt as follows: 

    @sentinel /create-connector Create a connector for Contoso. Here are the API docs: https://contoso-security-api.azurewebsites.net/v0101/api-doc

    :::image type="content" source="media/custom-connector-builder-agent/connector-vscode-prompt-agent.png" alt-text="Screenshot of the agent prompt in custom connector in VS Code Copilot chat in agent mode with the @sentinel /create-connector prompt" lightbox="media/custom-connector-builder-agent/connector-vscode-prompt-agent.png":::

  2. Provide the source API information,information and authentication methods to generate the appropriate connector pattern.

Step 3: Generate or update connector artifacts

Based on your input, the agent generates the following four files:

  • Schema and table references aligned with Sentinel requirements

The illustrationfollowing screenshot shows the four JSON connector files the agent generated.

:::image type="content" source="media/custom-connector-builder-agent/connector-files-sample.png" alt-text="Screenshot of four JSON connector files generated by the Sentinel connector file generatedbuilder agent in VS Code" lightbox="media/custom-connector-builder-agent/connector-files-sample.png":::

Refine the connector using the agent or by editing the generated JSON files directly. For example:

  • Ask the agent to modify the description, author name, or other fields

  • Update ingestion logic for table name

Validate the connector configuration

To confirm the connector can reach your data source API and retrieve events, follow these steps:

  1. To validate the API for data source events, right click on the folder that contains the ARM template and select Microsoft Sentinel > Test Connector.

    :::image type="content" source="media/custom-connector-builder-agent/connector-validation.png" alt-text="Screenshot of the Test Connector pane in VS Code with authentication fields for validating the connector API" lightbox="media/custom-connector-builder-agent/connector-validation.png":::

  2. In the Test Connector pane, enter the authentication details for your data source API, and then select Connect.

  • On the Events tab, review the request headers and the events returned by the API.

After you validate the connection, select Disconnect to stop the polling session.

Deploy the connector

To deploy the connector to a Microsoft Sentinel workspace, follow these steps:

  1. After the validation test succeeds, select Deploy in the chat window to start deploying the connector.

    :::image type="content" source="media/custom-connector-builder-agent/connector-deploy.png" alt-text="Screenshot of VS Code Copilot chat window with the Deploy button to deploy the Sentinel connector" lightbox="media/custom-connector-builder-agent/connector-deploy.png":::

  2. The extension opens a panel where you can choose from your available Microsoft Sentinel workspaces.

  3. Select a workspace, then select Deploy to deploy the connector to that workspace.

    :::image type="content" source="media/custom-connector-builder-agent/connector-workspace-deploy.png" alt-text="Screenshot of the Microsoft Sentinel workspace selection panel in VS Code for deploying the connector" lightbox="media/custom-connector-builder-agent/connector-workspace-deploy.png":::

Alternatively, right-click the folder that contains the generated files, select Microsoft Sentinel > Deploy Connector.

:::image type="content" source="media/custom-connector-builder-agent/connector-files-deploy.png" alt-text="Screenshot of the VS Code right-click context menu showing the Microsoft Sentinel Deploy Connector option" lightbox="media/custom-connector-builder-agent/connector-files-deploy.png":::

When deployment completes, a success message appears in the Output window.

:::image type="content" source="media/custom-connector-builder-agent/successful-deployment.png" alt-text="Screenshot of the VS Code Output window showing a successful connector deployment message" lightbox="media/custom-connector-builder-agent/successful-deployment.png":::

Get help