--- title: Microsoft Sentinel API Integration on Truto slug: mssentinel category: Security canonical: "https://truto.one/integrations/detail/mssentinel/" --- # Microsoft Sentinel API Integration on Truto **Category:** Security **Status:** Beta ## MCP-ready AI tools Truto exposes 98 tools for Microsoft Sentinel that AI agents can call directly. - **list_all_microsoft_sentinel_operations** — List all operations available for the Azure Security Insights (Microsoft Sentinel) Resource Provider. Returns: display, name, origin, isDataAction. - **list_all_microsoft_sentinel_alert_rule_templates** — List all alert rule templates in a Microsoft Sentinel workspace. Returns each template's kind. Required: workspace_name. - **get_single_microsoft_sentinel_alert_rule_template_by_id** — Get a single alert rule template in a Microsoft Sentinel workspace by id. Returns the template's kind. Required: id, workspace_name. - **list_all_microsoft_sentinel_alert_rules** — List all Microsoft Sentinel alert rules in a Log Analytics workspace. Returns each rule's kind and etag. Required: workspace_name. - **get_single_microsoft_sentinel_alert_rule_by_id** — Get a Microsoft Sentinel alert rule by id in a workspace. Returns: kind, etag. Required: id, workspace_name. - **update_a_microsoft_sentinel_alert_rule_by_id** — Create or update a Microsoft Sentinel alert rule by id (upsert). Returns the saved rule's kind and etag. Required: id, workspace_name, kind. - **delete_a_microsoft_sentinel_alert_rule_by_id** — Delete a Microsoft Sentinel alert rule by id within a Log Analytics workspace. Returns an empty 204 response on success. Required: id, workspace_name. - **list_all_microsoft_sentinel_actions** — List all actions of a Microsoft Sentinel alert rule. Returns: properties, etag. Required: workspace_name, rule_id. - **get_single_microsoft_sentinel_action_by_id** — Get a single action of a Microsoft Sentinel alert rule by id. Returns: properties, etag. Required: id, workspace_name, rule_id. - **update_a_microsoft_sentinel_action_by_id** — Create or update an action of a Microsoft Sentinel alert rule by id. Returns: properties, etag. Required: id, workspace_name, rule_id. - **delete_a_microsoft_sentinel_action_by_id** — Delete the action of an alert rule in Microsoft Sentinel. Returns an empty 204 response on success. Required: id, workspace_name, rule_id. - **list_all_microsoft_sentinel_automation_rules** — List all automation rules in a Microsoft Sentinel workspace. Returns each rule's etag and properties. Required: workspace_name. - **get_single_microsoft_sentinel_automation_rule_by_id** — Get a single Microsoft Sentinel automation rule by id. Returns: properties, etag. Required: id, workspace_name. - **update_a_microsoft_sentinel_automation_rule_by_id** — Create or update a Microsoft Sentinel automation rule by id. Returns the rule's etag and properties. Required: id, workspace_name, properties. - **delete_a_microsoft_sentinel_automation_rule_by_id** — Delete a Microsoft Sentinel automation rule by id. Returns an empty 204 response on success. Required: id, workspace_name. - **list_all_microsoft_sentinel_bookmarks** — List all bookmarks in a Microsoft Sentinel workspace. Returns each bookmark with its id, etag, and bookmark properties including display name, query, labels, notes, created/updated times and users, event time, query window, and incident info. Required: workspace_name. - **get_single_microsoft_sentinel_bookmark_by_id** — Get a Microsoft Sentinel bookmark by its bookmark ID. Returns the bookmark with its id, etag, and bookmark properties including display name, query, labels, notes, created/updated times and users, event time, query window, and incident info. Required: id, workspace_name. - **update_a_microsoft_sentinel_bookmark_by_id** — Create or update a Microsoft Sentinel bookmark by id. Returns: properties, etag. Required: id, workspace_name. - **delete_a_microsoft_sentinel_bookmark_by_id** — Delete a Microsoft Sentinel bookmark by id. Returns an empty 204 response on success. Required: id, workspace_name. - **list_all_microsoft_sentinel_content_packages** — List all installed content packages in a Microsoft Sentinel workspace. Returns per package: properties, etag. Required: workspace_name. - **get_single_microsoft_sentinel_content_package_by_id** — Get an installed content package by id in a Microsoft Sentinel workspace. Returns: properties, etag. Required: id, workspace_name. - **update_a_microsoft_sentinel_content_package_by_id** — Install a content package to a Microsoft Sentinel workspace by id (PUT). Returns the installed package: properties, etag. Required: id, workspace_name. - **delete_a_microsoft_sentinel_content_package_by_id** — Uninstall (delete) a Microsoft Sentinel content package from a Log Analytics workspace by id. Returns an empty 204 response on success. Requires id, subscription_id, resource_group_name, and workspace_name. Required: id, workspace_name. - **list_all_microsoft_sentinel_content_product_packages** — List all content product packages in the Microsoft Sentinel catalog for a workspace. Returns each package's id, name, etag, and properties (displayName, contentKind, installedVersion). properties/installed and properties/packagedContent are expandable. Required: workspace_name. - **get_single_microsoft_sentinel_content_product_package_by_id** — Get a content product package from the Microsoft Sentinel catalog by id. Returns the package's id, name, etag, and properties (displayName, contentKind, installedVersion, packagedContent). Required: id, workspace_name. - **list_all_microsoft_sentinel_content_product_templates** — List all templates in the Microsoft Sentinel content catalog for a workspace. Returns catalog template records with their ARM id, name, type, systemData, etag, and template property bag. Required: workspace_name. - **list_all_microsoft_sentinel_content_templates** — List all installed content templates in a Microsoft Sentinel workspace. Returns each template with its properties and etag. Required: workspace_name. - **get_single_microsoft_sentinel_content_template_by_id** — Get a single content template by id in a Microsoft Sentinel workspace. Returns the template with its properties and etag. Required: id, workspace_name. - **update_a_microsoft_sentinel_content_template_by_id** — Install a content template in a Microsoft Sentinel workspace. Returns the installed template with its properties and etag. Required: id, workspace_name. - **delete_a_microsoft_sentinel_content_template_by_id** — Delete an installed Microsoft Sentinel content template by id from the specified Log Analytics workspace. Returns an empty 204 response on success. Required: id, workspace_name. - **get_single_microsoft_sentinel_contentproducttemplate_by_id** — Get a Microsoft Sentinel content product template by id in the specified workspace. Returns: properties, etag. Required: id, workspace_name. - **list_all_microsoft_sentinel_data_connector_definitions** — List all Microsoft Sentinel data connector definitions in a Log Analytics workspace. Returns: kind, etag. Required: workspace_name. - **get_single_microsoft_sentinel_data_connector_definition_by_id** — Get a single Microsoft Sentinel data connector definition by id (its data connector definition name). Returns: kind, etag. Required: id, workspace_name. - **update_a_microsoft_sentinel_data_connector_definition_by_id** — Create or update a Microsoft Sentinel data connector definition by id. Returns: kind, etag. Required: id, workspace_name, kind. - **delete_a_microsoft_sentinel_data_connector_definition_by_id** — Delete a Microsoft Sentinel data connector definition. Returns an empty 204 response on success. Required: id, workspace_name. - **list_all_microsoft_sentinel_data_connectors** — List all data connectors in a Microsoft Sentinel workspace. Returns connectors with their id, kind, and etag. Required: workspace_name. - **get_single_microsoft_sentinel_data_connector_by_id** — Get a single data connector in a Microsoft Sentinel workspace by connector id. Returns: kind, etag. Required: id, workspace_name. - **update_a_microsoft_sentinel_data_connector_by_id** — Create or update a Microsoft Sentinel data connector by id. Returns: kind, etag. Required: id, workspace_name, kind. - **delete_a_microsoft_sentinel_data_connector_by_id** — Delete a Microsoft Sentinel data connector by id. Returns an empty 204 response on success. Required: id, workspace_name. - **create_a_microsoft_sentinel_entitie_run_playbook** — Run a Microsoft Sentinel playbook (Logic App) on a specific entity. Returns an empty 204 response on success. Required: workspace_name, entity_identifier, logicAppsResourceId. - **list_all_microsoft_sentinel_incidents** — List all Microsoft Sentinel incidents in a workspace. Returns incident records with their properties and etag. Max 1000 per page. Required: workspace_name. - **get_single_microsoft_sentinel_incident_by_id** — Get a single Microsoft Sentinel incident by id. Returns the incident with its properties and etag. Required: id, workspace_name. - **update_a_microsoft_sentinel_incident_by_id** — Create or update a Microsoft Sentinel incident by id; a new incident is created when the id does not exist. Returns the incident with its properties and etag. Required: id, workspace_name. - **delete_a_microsoft_sentinel_incident_by_id** — Delete a Microsoft Sentinel incident from the specified Log Analytics workspace by id. Returns an empty 204 response on success. Required: id, workspace_name. - **list_all_microsoft_sentinel_incident_alerts** — List all alerts for a Microsoft Sentinel incident. Returns: kind, properties. Required: workspace_name, incident_id. - **list_all_microsoft_sentinel_incident_bookmarks** — List the bookmarks linked to a Microsoft Sentinel incident. Returns the list of bookmarks, each with its id and bookmark attributes. Required: workspace_name, incident_id. - **get_single_microsoft_sentinel_incident_comment_by_id** — Get a Microsoft Sentinel incident comment by id. Returns the comment with its properties and etag. Required: id, workspace_name, incident_id. - **update_a_microsoft_sentinel_incident_comment_by_id** — Create or update a comment for a Microsoft Sentinel incident. Returns the comment with its properties and etag. Required: id, workspace_name, incident_id. - **delete_a_microsoft_sentinel_incident_comment_by_id** — Delete an incident comment from a Microsoft Sentinel incident. Returns an empty 204 response on success. Required: id, workspace_name, incident_id. - **list_all_microsoft_sentinel_incident_comments** — List all comments for a Microsoft Sentinel incident. Returns comments with their properties and etag. Required: workspace_name, incident_id. - **list_all_microsoft_sentinel_incident_entities** — List all entities associated with a Microsoft Sentinel incident. Returns each entity including its id and kind-specific attributes. Required: workspace_name, incident_id. - **list_all_microsoft_sentinel_incident_relations** — List all relations for a given Microsoft Sentinel incident. Returns each relation with its properties and etag. Required: workspace_name, incident_id. - **get_single_microsoft_sentinel_incident_relation_by_id** — Get a relation for a Microsoft Sentinel incident by id. Returns the relation with its properties and etag. Required: id, workspace_name, incident_id. - **update_a_microsoft_sentinel_incident_relation_by_id** — Create or update a relation for a Microsoft Sentinel incident by id. Returns the relation with its properties and etag. Relation id must be 3-63 alphanumeric characters or dashes. Required: id, workspace_name, incident_id. - **delete_a_microsoft_sentinel_incident_relation_by_id** — Delete a relation for a given incident in Microsoft Sentinel. Returns an empty 204 response on success. Required: id, workspace_name, incident_id. - **create_a_microsoft_sentinel_incident_run_playbook** — Run a playbook on a specific Microsoft Sentinel incident. Returns an empty 204 response on success. Required: workspace_name, incident_identifier, logicAppsResourceId. - **list_all_microsoft_sentinel_incident_tasks** — List all tasks for a Microsoft Sentinel incident. Returns each task's properties (title, status, createdTimeUtc, lastModifiedTimeUtc, createdBy, lastModifiedBy), etag, and resource id, name, and type. Required: workspace_name, incident_id. - **get_single_microsoft_sentinel_incident_task_by_id** — Get a single task on a Microsoft Sentinel incident by id. Returns the task's properties (title, status, createdTimeUtc, lastModifiedTimeUtc, createdBy, lastModifiedBy), etag, and resource id, name, and type. Required: id, workspace_name, incident_id. - **update_a_microsoft_sentinel_incident_task_by_id** — Create or update a task on a Microsoft Sentinel incident by id (upsert). Returns: properties, etag. Required: id, workspace_name, incident_id, properties. - **delete_a_microsoft_sentinel_incident_task_by_id** — Delete a Microsoft Sentinel incident task by id. Returns an empty 204 response on success. Required: id, workspace_name, incident_id. - **list_all_providers_microsoft_security_insights** — List Microsoft Sentinel repository metadata for a workspace. Returns: url, fullName, installationId, branches. Required: workspace_name, properties. - **list_all_microsoft_sentinel_metadata** — List all Microsoft Sentinel metadata in the specified workspace. Returns metadata records with their id, properties, and etag. Required: workspace_name. - **get_single_microsoft_sentinel_metadatum_by_id** — Get a Microsoft Sentinel metadata item by id. Returns the metadata record with its id, properties, and etag. Required: id, workspace_name. - **create_a_microsoft_sentinel_metadatum** — Create a Microsoft Sentinel metadata item in the specified workspace. Returns the created metadata record with its id, properties, and etag. Required: workspace_name, metadata_name. - **microsoft_sentinel_metadata_bulk_update** — Update an existing Microsoft Sentinel metadata item in the specified workspace. Returns the updated metadata record with its id, properties, and etag. Required: workspace_name, metadata_name. - **microsoft_sentinel_metadata_bulk_delete** — Delete a Microsoft Security Insights metadata item from the specified Operational Insights workspace. Returns an empty 204 response on success. Required: workspace_name, metadata_name. - **list_all_microsoft_sentinel_onboarding_states** — List all Microsoft Sentinel onboarding states in a Log Analytics workspace. Returns: properties, etag. Required: workspace_name. - **get_single_microsoft_sentinel_onboarding_state_by_id** — Get a Microsoft Sentinel onboarding state by id. Returns: properties, etag. The onboarding state name supports 'default'. Required: id, workspace_name. - **create_a_microsoft_sentinel_onboarding_state** — Create or update a Microsoft Sentinel onboarding state in a Log Analytics workspace. Returns: properties, etag. The onboarding state name supports 'default'. Required: workspace_name, sentinel_onboarding_state_name. - **microsoft_sentinel_onboarding_states_bulk_delete** — Delete a Microsoft Sentinel onboarding state for a Log Analytics workspace. Returns an empty 204 response on success. Required: workspace_name, sentinel_onboarding_state_name. - **list_all_microsoft_sentinel_security_ml_analytics_settings** — List all Security ML Analytics Settings for a Microsoft Sentinel workspace. Returns one setting record per item: kind, etag. Required: workspace_name. - **get_security_ml_analytics_setting_by_id** — Get a single Security ML Analytics Settings resource by id in Microsoft Sentinel. Returns: kind, etag. Required: id, workspace_name. - **microsoft_sentinel_security_ml_analytics_settings_bulk_update** — Create or update a Security ML Analytics Settings resource in Microsoft Sentinel. Returns: kind, etag. Required: workspace_name, settings_resource_name, kind. - **microsoft_sentinel_security_ml_analytics_settings_bulk_delete** — Delete a Security ML Analytics Settings resource in Microsoft Sentinel by resource name. Returns an empty 204 response on success. Required: workspace_name, settings_resource_name. - **list_all_microsoft_sentinel_sourcecontrols** — List all source controls in a Microsoft Sentinel workspace. Returns: properties, etag. Source control items are not included. Required: workspace_name. - **get_single_microsoft_sentinel_sourcecontrol_by_id** — Get a single source control by id in a Microsoft Sentinel workspace. Returns: properties, etag. Required: id, workspace_name. - **create_a_microsoft_sentinel_sourcecontrol** — Create a source control in a Microsoft Sentinel workspace. Returns the created source control with its properties and etag. Required: workspace_name, sourcecontrol_id, properties. - **delete_a_microsoft_sentinel_sourcecontrol_delete_by_id** — Delete a source control connection in Microsoft Sentinel by id (the source control id). Returns: warning — details of any cleanup Sentinel could not do automatically (service principal, pipeline, workflow or secret, role assignment). Required: id, workspace_name, subscription_id, resource_group_name, properties (repository access credentials). - **create_a_microsoft_sentinel_main_create_indicator** — Create a new threat intelligence indicator in Microsoft Sentinel. Returns the created indicator resource: id, name, type, properties. Required: workspace_name, kind. - **list_all_microsoft_sentinel_main_indicators** — List all threat intelligence indicators in a Microsoft Sentinel workspace. Returns indicators with their kind and etag. Required: workspace_name. - **get_single_microsoft_sentinel_main_indicator_by_id** — Get a single Microsoft Sentinel threat intelligence indicator by id (the indicator name). Returns the indicator's kind and etag. Required: id, workspace_name. - **create_a_microsoft_sentinel_main_indicator** — Create or update a Microsoft Sentinel threat intelligence indicator identified by name. Returns the indicator's kind and etag. Required: workspace_name, name, kind. - **delete_a_microsoft_sentinel_main_indicator_by_id** — Delete a Microsoft Sentinel threat intelligence indicator by id. Returns an empty 204 response on success. Required: id, workspace_name. - **create_a_microsoft_sentinel_indicator_append_tag** — Append tags to a threat intelligence indicator in Microsoft Sentinel. Returns a 200 response with an empty body on success. Required: workspace_name, name. - **create_a_microsoft_sentinel_indicator_replace_tag** — Replace the tags on a Microsoft Sentinel threat intelligence indicator identified by name. Returns: kind, etag. Required: workspace_name, name, kind. - **list_all_microsoft_sentinel_main_metrics** — List threat intelligence indicator metrics for a Microsoft Sentinel workspace. Returns metric records whose properties object holds indicator counts by type, threat type, and source. Required: workspace_name. - **create_a_microsoft_sentinel_main_query_indicator** — Query Microsoft Sentinel threat intelligence indicators by filtering criteria such as confidence, sources, pattern types, threat types, and keywords. Returns matching indicators with their kind and etag. Required: workspace_name. - **list_all_microsoft_sentinel_watchlists** — List Microsoft Sentinel watchlists for a workspace, without their watchlist items. Returns watchlist records with properties and etag. Required: workspace_name. - **get_single_microsoft_sentinel_watchlist_by_id** — Get a single Microsoft Sentinel watchlist by id (its watchlist alias), without its watchlist items. Returns the watchlist with properties and etag. Required: id, workspace_name. - **update_a_microsoft_sentinel_watchlist_by_id** — Create or update a Microsoft Sentinel watchlist by id; to bulk-create the watchlist together with its watchlist items, pass rawContent and contentType (e.g. text/csv). Returns the watchlist with properties and etag. Required: id, workspace_name. - **delete_a_microsoft_sentinel_watchlist_by_id** — Delete a watchlist in Microsoft Sentinel by id (the watchlist alias). Returns an empty 204 response on success. Deletion is asynchronous — 202 Accepted, track via the Azure-AsyncOperation header. Required: id, workspace_name. - **list_all_microsoft_sentinel_watchlist_watchlist_items** — List all watchlist items in a Microsoft Sentinel watchlist. Returns: properties, etag. Required: workspace_name, watchlist_alias. - **get_single_microsoft_sentinel_watchlist_watchlist_item_by_id** — Get a Microsoft Sentinel watchlist item by id. Returns: properties, etag. Required: id, workspace_name, watchlist_alias. - **update_a_microsoft_sentinel_watchlist_watchlist_item_by_id** — Create or update a Microsoft Sentinel watchlist item by id. Returns: properties, etag. Required: id, workspace_name, watchlist_alias. - **delete_a_microsoft_sentinel_watchlist_watchlist_item_by_id** — Delete a watchlist item from a Microsoft Sentinel watchlist. Returns an empty 204 response on success. Required: id, workspace_name, watchlist_alias. - **list_all_microsoft_sentinel_subscriptions** — List the Azure subscriptions the connected identity can access. Use this first to find the subscription_id that every other Microsoft Sentinel tool needs. Returns: subscriptionId, displayName, state, tenantId. No parameters. - **list_all_microsoft_sentinel_workspaces** — List the Log Analytics workspaces in an Azure subscription. Microsoft Sentinel runs on a Log Analytics workspace, so use this to find workspace_name and resource_group_name: the workspace name is `name`, and the resource group is the segment after /resourceGroups/ in `id`. Returns: id, name, location, properties (customerId, provisioningState, sku, retentionInDays). Required: subscription_id. - **list_all_microsoft_sentinel_solutions** — List the monitoring solutions installed in an Azure subscription. A Log Analytics workspace has Microsoft Sentinel enabled when a solution named `SecurityInsights()` exists; its properties.workspaceResourceId points at that workspace. Returns: id, name, location, plan (name, product, publisher), properties (workspaceResourceId, provisioningState). Required: subscription_id. ## How it works 1. **Link your customer's Microsoft Sentinel account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app. 2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request. 3. **Call Truto's API to reach Microsoft Sentinel.** The Proxy API is a 1-to-1 mapping of the Microsoft Sentinel API. 4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field. ## Use cases - **Embed bi-directional incident sync in your ITSM or ticketing product** — Give customers running SOCs on Sentinel a native way to mirror incidents, comments, assignments, and status changes into your platform. Analysts can work from your UI while Sentinel stays authoritative, without your team maintaining Azure Resource Manager auth or incident schema quirks. - **Stream threat intelligence into customer Sentinel workspaces** — If you sell a threat intel or EDR SaaS, push curated IOCs — IPs, URLs, hashes, domains — directly into each customer's Sentinel threat intel blade. Truto handles the per-tenant auth so your indicators land in the right workspace with the right tags. - **Sync HR, identity, and asset context into Sentinel Watchlists** — HR, IGA, ITAM, and CSPM products can keep Sentinel Watchlists continuously updated with terminated employees, VIPs, crown-jewel assets, or vulnerable devices. This turns your source-of-truth data into high-fidelity detection context for the customer's SOC. - **Trigger Sentinel playbooks from your security product** — CSPM, DSPM, EDR, and SOAR-adjacent SaaS tools can execute customer-defined Sentinel playbooks against specific incidents or entities when they detect an issue. This lets your product drive remediation inside the Microsoft ecosystem without rebuilding Logic Apps logic. - **Offer MSSP-grade multi-tenant Sentinel management** — MSSP tooling and reporting SaaS can list subscriptions and workspaces per customer and operate across them from one surface. Truto manages the Azure OAuth and tenant isolation so you can focus on cross-client analytics and workflows. ## What you can build - **Two-way incident sync with comments and tasks** — Mirror Sentinel incidents into your app and push back status, owner, comments, and incident tasks using the incidents, incident comments, and incident tasks endpoints. - **Threat intelligence indicator pipeline** — Create, query, tag, and delete Sentinel threat intel indicators so your platform can continuously manage the lifecycle of IOCs inside each customer's workspace. - **Watchlist sync for context enrichment** — Programmatically create and update Sentinel Watchlists and Watchlist Items from your HR, identity, or asset data, with support for bulk refreshes on a schedule. - **Playbook execution from your UI** — Let users trigger Sentinel playbooks against specific incidents or entities directly from your product, with the Logic App run initiated via Sentinel's run-playbook endpoints. - **Detection rule and analytics management** — Expose Sentinel alert rules, alert rule templates, and ML analytics settings in your app so customers can view, edit, or deploy detections without leaving your product. - **Threat-hunting bookmark publisher** — Push hunt findings and KQL query results from your analytics platform into Sentinel as bookmarks so analysts can promote them to incidents later. ## FAQs ### How does authentication to Microsoft Sentinel work? Sentinel is an Azure resource, so authentication uses Microsoft Entra ID (Azure AD) OAuth against Azure Resource Manager. Truto handles the OAuth flow, token refresh, and scoping to the customer's subscription and Log Analytics workspace so your end users just click connect. ### Does the integration support multiple subscriptions and workspaces per customer? Yes. You can call list_all_microsoft_sentinel_subscriptions and list_all_microsoft_sentinel_workspaces to let the end user pick which workspace to connect, which is especially useful for enterprises and MSSPs managing many tenants. ### Can we create and manage incidents, or only read them? Full CRUD is supported on incidents, incident comments, incident tasks, and incident relations. You can also list incident alerts, bookmarks, and entities tied to an incident to build a complete investigation view. ### How do we push threat intelligence indicators into Sentinel? Use the create indicator endpoints to add IOCs, append or replace tags on them, query indicators, and delete them when they're deprecated — giving you a full lifecycle for threat intel feeds inside the customer's Sentinel instance. ### Can our product trigger Sentinel playbooks? Yes. Truto exposes endpoints to run a playbook against a specific incident or against an entity, so your app can orchestrate remediation using the customer's existing Azure Logic Apps. ### How are rate limits and pagination handled? Sentinel inherits Azure Resource Manager's throttling and uses nextLink-style pagination. Truto normalizes pagination across list endpoints and transparently handles retries and backoff so you don't have to code against ARM's quirks. ### What about data connectors, analytics rules, and watchlists? You can list, read, update, and delete data connectors and data connector definitions, alert rules, ML analytics settings, and watchlists plus their items — enough to build configuration and sync experiences on top of Sentinel.