Description
The D3 Smart SOAR data connector pulls incidents from D3 Smart SOAR into Microsoft Sentinel using the D3 codeless REST API command endpoint.
- Declared status
- 1
- Declared author / publisher
- D3 Security
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
Read and Write permissions are required.
Workspace
Workspace
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
Connect D3 Smart SOAR to Microsoft Sentinel
**Prerequisite:** In D3 Smart SOAR, navigate to **Organization Management → Sites**, select the site you are connecting, and set its **Time Zone** to **(UTC+00:00) Coordinated Universal Time**. This ensures incident timestamps are correctly aligned with Microsoft Sentinel.
Enter your D3 Smart SOAR connection details below. Incidents will be polled every 5 minutes and written to the **D3SOARIncidents_CL** table.
**Server URL** — The base URL of your D3 Smart SOAR deployment, up to and including the site path. Do not include the API path.
**Username** — Your D3 Smart SOAR account username (same as your portal login).
**Site** — The D3 Smart SOAR site name your account belongs to (e.g. `Security Operations`).
**D3 JWT** — A JSON Web Token issued by D3 Smart SOAR for API authentication.
Server URL
Username
Site
D3 JWT
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
D3SOARConnectorDefinition
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC