Skip to main content

Targets: Management

The Targets web interface provides comprehensive management for output destinations where processed telemetry data is forwarded.

Access​

Navigate to Home > Fleet Management > Targets, or use the hamburger menu and select Fleet Management > Targets.

Overview​

The Targets page is where you manage all output destinations for DataStream. Targets are data senders that forward processed telemetry to external systems and convert from standardized pipeline output to destination-specific formats.

The Targets page presents a persistent left sidebar listing all target types in expandable category accordions, in this order: Microsoft Azure, Amazon Web Services (AWS), Google Cloud (GCP), IBM Cloud, Analytics, SIEM, Cloud storage, Message queues, and Other. Each target type entry shows its name and a count of configured instances.

Above the accordion:

  • A Show configured targets only toggle hides target types with no configured instances
  • A search field with the placeholder Search target types filters the sidebar by name; an empty result shows "No configured targets found"

Selecting a target type in the sidebar opens that type's list table in the main panel.

List View​

The list view shows all instances of the selected target type.

Table​

The table displays Name, Description, Directors, Post-processing pipeline, Sensitive data, Log stream, Status (Enabled/Disabled), Monitoring and Connection status for each target, with an Actions menu (⋮) on each row. Sensitive data shows Not protected when the target receives sensitive values as they are. Otherwise it shows how the director protects them: Redacted, Masked, Hashed or Encrypted. See Targets: Data Protection.

Table Controls​

Filter targets using the search field — its placeholder names the selected type (for example, "Search Elasticsearch targets") — and the Status dropdown (All, Enabled, Disabled). Click Add new target to launch the creation wizard.

Actions​

Each target row provides an Actions menu (⋮) with the following operations:

View and Edit:

  • Manage target - Navigate to target detail view

Status Management:

  • Enable target / Disable target - Toggle target status (shown according to current status)

Configuration:

  • Clone target - Duplicate target configuration for quick setup

Deletion:

  • Delete target - Remove target from platform

Creation Wizard​

The target creation process uses a multi-step wizard with target-specific configuration.

Target wizards have different numbers of steps depending on the target type. Each step is labeled with its specific name rather than a generic step number. Every wizard begins with General settings, followed by the steps of the target type. Then come Execution settings and Data protection, on every target. The Microsoft Sentinel and Microsoft Sentinel data lake targets add a Smart Engine step after them. Every wizard ends with Review and create.

General Settings​

Applies to: All targets

  • Target name - Unique target identifier
  • Target Status - Enable or disable target
  • Post-processing pipeline (Optional) - Pipeline for output normalization

Azure Settings​

Applies to: AzureBlobStorage, AzureDataExplorer, AzureEventHubs, AzureMonitorLogs, AzureServiceBus, MicrosoftSentinel, MicrosoftSentinelDataLake

Azure-specific configuration including authentication and resource identification:

  • Authentication - Managed Identities, Service Principal, or Connection String. AzureServiceBus has no Managed Identities toggle; its Authentication method dropdown offers Connection string, Service principal, Managed identity (user-assigned), and Managed identity (system-assigned) or workload identity
  • Tenant ID / Client ID / Client Secret - Service Principal credentials
  • Workspace/Subscription - Azure resource identification
  • Resource Group - Azure resource grouping
  • Container / Database / Namespace - Target-specific resource names

Azure Service Configuration​

Applies to: AzureBlobStorage, AzureDataExplorer, AzureEventHubs, AzureMonitorLogs, AzureServiceBus, MicrosoftSentinel, MicrosoftSentinelDataLake

Target-specific Azure configuration following the Azure settings step. The step name and fields vary by target:

  • Stream settings (AzureMonitorLogs, MicrosoftSentinel, MicrosoftSentinelDataLake) — Stream name, table name, DCR rule ID, DCE endpoint
  • Storage settings (AzureBlobStorage, AzureDataExplorer) — Container, database, storage configuration
  • Message settings (AzureServiceBus) — Queue/topic name, message configuration
  • Advanced settings (AzureEventHubs) — Max retry, retry interval, timeout, batch configuration

Authentication​

Applies to: AmazonOpenSearch, Elasticsearch, ElasticSecurity, GoogleChronicle, GoogleSecOps, Splunk, SplunkSecurity

Authentication credentials and endpoint configuration:

  • Endpoints - Destination URLs or addresses
  • Authentication Type - Token, secret, or basic authentication
  • Username / Password - Basic authentication credentials (Elasticsearch, ElasticSecurity, AmazonOpenSearch)
  • Token / Secret - Token-based authentication (Splunk, SplunkSecurity)
  • TLS Configuration - Certificate and encryption settings

Target Properties​

Applies to: AmazonOpenSearch, Elasticsearch, ElasticSecurity, GoogleChronicle, GoogleSecOps, Splunk, SplunkSecurity

Target-specific configuration following the endpoint step, which is Endpoints on AmazonOpenSearch, Splunk and SplunkSecurity and Connection settings on Elasticsearch and ElasticSecurity. The step name and fields vary by target:

  • Splunk settings (Splunk) and Splunk ES settings (SplunkSecurity) — Index, Source Type, Batch Size, Timeout, TCP Routing, Compression, TLS skip verify, Field Format
  • Elasticsearch settings (Elasticsearch) — Index name, document type, ingest pipeline, bulk configuration
  • Elastic Security settings (ElasticSecurity) — Index name, document type, ingest pipeline, bulk configuration
  • OpenSearch settings (AmazonOpenSearch) — Index name, document type, ingest pipeline, bulk configuration
  • Google Chronicle settings (GoogleChronicle) — Chronicle-specific settings, followed by a Log and batch settings step
  • Google SecOps settings (GoogleSecOps) — SecOps-specific settings, followed by a Log and batch settings step

Connection, Event and TLS Settings​

Applies to: SplunkS2s

The Splunk S2S target is a separate implementation from the HEC sender, so it has no endpoint step and no HEC token. Its three type-specific steps are:

  • Connection settings — Address and port of the first indexer, a Send to additional indexers toggle (off by default) that reveals the weighted Indexers list (address, port, weight), load balancing intervals, protocol version, acknowledgement, compression, server name and management port
  • Event settings — Index, host, source and source type attribution, Splunk envelope metadata extraction, nested field serialization, field format, batch size, timeout, maximum event size, throttling, and retry settings
  • TLS settings — Server verification, SNI, CA certificate, client certificate and key, passphrase and the TLS version range

AWS Connection Properties​

Applies to: AmazonCloudWatchLogs, AmazonKinesis, AmazonMSK, AmazonSNS, AmazonSQS

AWS connection and credential configuration:

  • Region - AWS region
  • Access Key ID - AWS access credentials
  • Secret Access Key - AWS secret credentials
  • Endpoint - Service endpoint URL

AWS Service Configuration​

Applies to: AmazonCloudWatchLogs, AmazonKinesis, AmazonMSK, AmazonSNS, AmazonSQS

Target-specific AWS configuration following the AWS settings step (Connection settings on AmazonMSK). The step name and fields vary by target:

  • Stream settings (AmazonKinesis) — Stream name, partition key
  • Producer settings + TLS settings (AmazonMSK) — Topic, partition settings, TLS certificate configuration
  • Topic settings (AmazonSNS) — Topic ARN, message attributes
  • Queue settings (AmazonSQS) — Queue URL, message settings
  • Log settings (AmazonCloudWatchLogs) — Log group, log stream

AWS Data Warehouse​

Applies to: AmazonRedshift

Amazon Redshift data warehouse configuration takes two steps:

  • Connection settings — Region, Access Key ID, Secret Access Key, then the cluster endpoint, database, schema, credentials and port
  • Staging and tables — S3 bucket and prefix for staging data loads, target table name and table list, and batch size and flush settings

SQL Database Settings​

Applies to: PostgreSQL, TimescaleDB, MySQL, SQL Server

The SQL database targets are listed in the Analytics category, after ClickHouse. They take three steps of their own, between General settings and Execution settings:

  • Connection settings — Address, Port (prefilled with the type's port: 5432 for PostgreSQL and TimescaleDB, 3306 for MySQL, 1433 for SQL Server), Database and Timeout; under Authentication, Username and Password; and the TLS settings
  • Table settings — a notice that the table must already exist; Schema (prefilled with public, or dbo on SQL Server; MySQL has no Schema field) and Table; then, under JSON column, the Whole record as JSON switch and, while it is on, Column name
  • Delivery settings — Batch size, Maximum batch payload and Field format

The database, schema, table and column names must start with a letter or an underscore and use only letters, digits and underscores; the wizard refuses any other name. See PostgreSQL, TimescaleDB, MySQL and SQL Server for what each setting does.

InfluxDB Line Protocol Settings​

Applies to: InfluxDB, Amazon Timestream for InfluxDB, VictoriaMetrics, GreptimeDB, QuestDB

Amazon Timestream for InfluxDB is listed in the Amazon Web Services (AWS) category, after Amazon Redshift, and the other four in the Analytics category, after SQL Server. They take four steps of their own, between General settings and Execution settings; QuestDB takes three, because it has no Database settings step:

  • Connection settings — Address, Port, API version (InfluxDB and Amazon Timestream for InfluxDB only; while the target is being created, the port follows it) and Timeout; under Authentication, Token, Username and Password, as each type takes them; and the TLS settings. Amazon Timestream for InfluxDB has no TLS encryption switch: it always uses HTTPS
  • Database settings — the fields that say where the points land under the chosen API version: Database and Retention policy (InfluxDB v1), Organization and Bucket (v2), Database (v3); Database and Tenant on VictoriaMetrics; Database on GreptimeDB. QuestDB has no such step
  • Point mapping — a notice that records from the InfluxDB device keep their measurement, tags and fields; then Measurement field, Measurement, Tag fields and Value fields
  • Delivery settings — Batch size, Maximum batch payload and Field format

Then come Execution settings, Data protection, and Review and create. See InfluxDB, Amazon Timestream for InfluxDB, VictoriaMetrics, GreptimeDB and QuestDB for what each setting does.

S3 and Cloud Storage Properties​

Applies to: AlibabaS3, AmazonS3, AmazonSecurityLake, BackblazeS3, CloudflareR2, DigitalOceanS3, IbmCos, Minio, ScalewayS3

S3-compatible cloud storage configuration. All targets in this group have two steps — file properties and storage/connection properties:

  • Endpoint - Storage service endpoint URL
  • Access Key ID / Secret Access Key - Storage access credentials
  • Bucket - Target storage bucket name
  • Region - Storage region (where applicable)
  • File name template - Output file naming pattern with template support
  • Format - Output format (JSON, Parquet, Avro, etc.)
  • Compression - Optional data compression (zstd, gzip, etc.)

AmazonSecurityLake uses a different layout (AWS settings + Security Lake settings): the bucket, the custom source and its OCSF event class, the file name template and compression, with Parquet as the format.

Message Queue Properties​

Applies to: ConfluentCloud, Kafka, Redpanda

Message queue connection and producer configuration:

  • Connection settings — Broker addresses, topic, authentication
  • TLS settings — Certificate, key, and CA configuration

BigQuery Properties​

Applies to: BigQuery

Google BigQuery configuration with three steps:

  • Google Cloud settings — Project ID, credentials, dataset
  • Streaming settings — Streaming insert configuration
  • Tables — Target table name, schema settings

File Settings​

Applies to: File

File output configuration:

  • File Path - Output directory and file naming pattern
  • File Format - Output format (JSON, Parquet, Avro, etc.)
  • Compression - Optional data compression

Console Settings​

Applies to: Console

Console output format configuration for debugging and testing:

  • Output Format - Display format for console output
  • Pretty Print - Formatted JSON output option

Execution Settings​

Applies to: All targets

The Execution settings step configures target execution scheduling and debugging options.

Scheduling:

The Scheduling toggle switches scheduled delivery on.

  • When it is off, the target delivers data continuously as it arrives
  • When it is on, the director accumulates the data and delivers it each time the schedule fires

Scheduling Method:

Under Scheduling method, choose one of two radio tiles:

  • Cron-based — delivers at specific times or dates named by a cron expression. Use it for fixed clock times, such as a nightly run
  • Interval-based — delivers at regular, fixed intervals, such as every 10 minutes. Use it for a steady rate

Cron Schedule:

When Cron-based is selected, the Cron schedule section appears. The director delivers at the times the expression names, in its own local time zone.

  1. Pattern — choose a calendar preset. Sub-daily frequencies are left to Interval-based, so the presets only name wall-clock moments:

    • Custom — enter your own cron expression
    • Every day at midnight (0 0 * * *)
    • Every weekday at midnight (0 0 * * 1-5)
    • Every Sunday at midnight (0 0 * * 0)
    • Monthly on day 1 at midnight (0 0 1 * *)

    Midnight renders through your own clock convention, so a 12-hour or 24-hour time can appear in its place.

  2. Custom — when selected:

    • An info alert, Special characters, explains *, ,, - and /
    • Cron expression takes five fields separated by spaces: minute, hour, day of month, month and day of week, where 0 is Sunday. Six or seven fields, as Quartz writes them, start with the second, may end with the year and count Sunday as 1
    • Test expression shows the expression and a human-readable reading of it. For example, 0 */3 * * * reads as "Run every 3 hours"

Interval Schedule:

When Interval-based is selected, the Interval schedule section appears. The director delivers once per interval, counted from when the target starts.

  1. Interval — choose from predefined intervals:

    • Custom — enter your own interval
    • 30 seconds (30s)
    • 1 minute (1m)
    • 5 minutes (5m)
    • 10 minutes (10m)
    • 15 minutes (15m)
    • 30 minutes (30m)
    • 1 hour (1h)
    • 2 hours (2h)
    • 6 hours (6h)
    • 12 hours (12h)
    • 24 hours (24h)

  2. Custom interval — when Custom is selected:

    • An info alert, Interval format, explains the format
    • A number followed by a unit: s (seconds), m (minutes), h (hours) or d (days)
    • Without a unit the number is in seconds, so 300 is 5 minutes
    • Examples: 90s, 45m, 2h, 2d

For the expression format in depth, see Cron-Based Scheduling and Interval-Based Scheduling.

Debugging:

Use debugging to inspect what a target receives, and, with Don't send logs, to test it without delivering data.

  • Debugging — toggle to log each event for the target. On its own it does not stop delivery: the target still receives the data
  • Don't send logs — shown when debugging is on. With it on as well, the director still processes the data but sends nothing to the target, which is useful for validating a configuration without affecting production systems

Data Protection​

Applies to: All targets. Enterprise edition.

The Data protection step decides whether the target may receive sensitive data as it is. Sensitive data means values such as passwords, card numbers and national IDs. The sensitive data rules in the Library decide which values count.

  • Protect sensitive data — a switch under Sensitive data in this target, off by default. Off, the director sends records as they are. On, it protects sensitive values before it sends each record. Only enabled rules protect anything: if none of the rules you choose below is enabled, the target receives records unchanged.

When the switch is on, more fields appear:

  • What to protect — one checkbox for each category: Credentials and secrets, Payment and banking, National IDs, Contact details and Network. If you can read the Library, each category shows how many enabled rules it has. The first three are selected at first. Contact details and Network are not, because a SIEM usually needs email addresses and IP addresses to detect attacks. Choose rules instead replaces the checkboxes with a list of the enabled rules, and Choose categories instead switches back. Only the choice on screen is saved. Manage sensitive data rules opens the Library's rules in a new browser tab.
  • How to protect it — Redact (the default), Mask, Hash or Encrypt. Each tile shows what the director writes for a card number. If the director can't protect a record, it doesn't send it.
  • Key — for Hash and Encrypt only. The key is 32 random bytes, written as 64 hexadecimal characters or in base64. It can be typed in (Manual), or come from an Environment variable on the director or from Vault. Vault is the safest place for it. For a key that you type in, Generate a key, beside the field, makes one in your browser. Keep a copy: without the key, nobody can read the encrypted values or find a value by its hash.

On an edition without data protection, the step shows an Enterprise plan card instead, and the target is created without protection. For what a protected target receives, and how to decrypt it, see Targets: Data Protection.

Review and Create​

The final wizard step, Review and create, shows a summary of all entered configuration values. Click Create target to create the target.

Wizard Navigation​

Progress Indicator:

  • Visual step progress at top of wizard
  • Click steps to navigate (after validation)
  • Current step highlighted
  • Completed steps marked with checkmark

Navigation Buttons:

  • Cancel - Exit wizard without creating target
  • Back - Return to previous step
  • Next step - Advance to next step with validation
  • Create target - Finalize target creation (final step)

Detail View​

Clicking a target from the list opens the detailed management interface with tabbed panels. All targets display General Settings, Execution Settings, Data protection, Health, Data flow, Live Data, and Activity logs tabs (Health and Data flow need the Stats permission). The intermediate configuration tabs vary by target category.

  • Health — throughput, queue depth and delivery lag, errors and drops by stage, the devices routing to the target, and the runtime resources of the directors carrying it, over a selectable window with live polling
  • Data flow — which routes are configured to reach the target and what each delivered in the window, which devices sent to it and through which route, the top source and its share, and a sources → routes → target diagram; Quick Route traffic and deliveries a director cannot attribute to a route are shown as their own nodes
  • Live Data — captures data flowing to the target in real time (see Live Data); shows a message in place of a capture when the target is disabled, or when every Director it runs on is a standalone Director that is not connected
  • Activity logs — target configuration change history

General Settings Tab​

Applies to: All targets

  • Target name - Editable target name
  • Description - Editable target description
  • Status - Current operational state
  • Edit Mode - Click edit to modify general settings

Azure Targets​

Applies to: AzureBlobStorage, AzureDataExplorer, AzureEventHubs, AzureMonitorLogs, AzureServiceBus, MicrosoftSentinel, MicrosoftSentinelDataLake

Azure targets display the following configuration tabs:

  • Azure settings (AzureBlobStorage, AzureDataExplorer, AzureMonitorLogs, AzureServiceBus, MicrosoftSentinel, MicrosoftSentinelDataLake) — Authentication, workspace, subscription details
  • Stream settings (AzureMonitorLogs, MicrosoftSentinel, MicrosoftSentinelDataLake) — Stream name, table, DCR settings
  • Storage settings (AzureBlobStorage, AzureDataExplorer) — Container, database configuration
  • Message settings (AzureServiceBus) — Queue/topic configuration
  • Advanced settings (AzureEventHubs) — Retry, timeout, batch settings

Analytics and SIEM Targets​

Applies to: AmazonOpenSearch, Elasticsearch, ElasticSecurity, GoogleChronicle, GoogleSecOps, Splunk, SplunkSecurity, SplunkS2s

Analytics and SIEM targets display the following configuration tabs:

  • Authentication (all except SplunkS2s) — Endpoint URLs, credentials, TLS settings
  • Splunk HEC Properties (Splunk, SplunkSecurity) — Index, source type, batch size, timeout, compression, field format
  • Chronicle Properties + Log Settings (GoogleChronicle) — Chronicle configuration and log settings
  • SecOps Properties (GoogleSecOps) — SecOps configuration
  • Connection / Event / TLS Settings (SplunkS2s) — Indexer tier and load balancing, event attribution and delivery, TLS. This target is not the HEC sender, so it has no Authentication tab

Elasticsearch, ElasticSecurity, and AmazonOpenSearch display only the Authentication tab for detail view configuration.

SQL Database Targets​

Applies to: PostgreSQL, TimescaleDB, MySQL, SQL Server

SQL database targets display a tab for each of their three wizard steps:

  • Connection settings — Address, port, database, timeout, username and password, and TLS. Edit with Manage connection settings
  • Table settings — Schema (not on MySQL), table and the JSON column. Edit with Manage table settings
  • Delivery settings — Batch size, maximum batch payload and field format. Edit with Manage delivery settings

InfluxDB Line Protocol Targets​

Applies to: InfluxDB, Amazon Timestream for InfluxDB, VictoriaMetrics, GreptimeDB, QuestDB

InfluxDB line protocol targets display a tab for each of their wizard steps:

  • Connection settings — Address, port, API version (InfluxDB and Amazon Timestream for InfluxDB), timeout, the sign-in, and TLS. Edit with Manage connection settings
  • Database settings (all except QuestDB) — Where the points land. Edit with Manage database settings
  • Point mapping — Measurement field, measurement, tag fields and value fields. Edit with Manage point mapping
  • Delivery settings — Batch size, maximum batch payload and field format. Edit with Manage delivery settings

AWS Targets​

Applies to: AmazonCloudWatchLogs, AmazonKinesis, AmazonMSK, AmazonRedshift, AmazonS3, AmazonSecurityLake, AmazonSNS, AmazonSQS

AWS targets display the following configuration tabs:

  • AWS settings (AmazonCloudWatchLogs, AmazonKinesis, AmazonSNS, AmazonSQS) and Connection settings (AmazonMSK) — Region, credentials, endpoint
  • Stream settings (AmazonKinesis) — Stream name, partition key
  • Producer settings (AmazonMSK) — Topic, partition settings
  • TLS settings (AmazonMSK) — Certificate configuration
  • Topic settings (AmazonSNS) — Topic ARN, message attributes
  • Queue settings (AmazonSQS) — Queue URL, message settings
  • Log settings (AmazonCloudWatchLogs) — Log group, log stream
  • Connection settings (AmazonRedshift) — Region, access credentials, cluster endpoint, database, schema
  • Staging and tables (AmazonRedshift) — Staging bucket configuration, target table, column mapping
  • AWS settings + File settings (AmazonS3) — File format, compression, bucket, credentials
  • AWS settings + Security Lake settings (AmazonSecurityLake) — Bucket, account ID, custom source, OCSF event class, file name template, compression, file rotation

S3-Compatible Cloud Storage Targets​

Applies to: AlibabaS3, BackblazeS3, CloudflareR2, DigitalOceanS3, IbmCos, Minio, ScalewayS3

All S3-compatible cloud storage targets display two tabs:

  • File settings — File name pattern, format, compression
  • A settings tab named for the provider (for example MinIO settings or Cloudflare R2 settings) — Endpoint, access credentials, bucket, region

Message Queue Targets​

Applies to: ConfluentCloud, Kafka, Redpanda

All message queue targets display three tabs:

  • Connection settings — Broker addresses, topic, authentication
  • Producer settings — Producer configuration and tuning
  • TLS settings — Certificate, key, and CA configuration

GCP Targets​

Applies to: BigQuery

  • Google Cloud settings — Project ID, credentials, dataset
  • Streaming settings — Streaming insert configuration
  • Tables — Target table and schema settings

Utility Targets​

Applies to: Console, File

  • Console settings (Console) — Output format, pretty print
  • File settings (File) — File path, format, compression

Execution Settings Tab​

Applies to: All targets

Displays and allows editing of scheduling and debugging configuration:

Scheduling Section:

  • Current scheduling status (Enabled/Disabled)
  • Scheduling method (Cron or Interval)
  • Current schedule pattern or interval
  • Edit mode allows modification of all scheduling settings

Debugging Section:

  • Debug logging status (Enabled/Disabled)
  • Don't send logs status (Enabled/Disabled when debugging active)
  • Edit mode allows modification of debug settings

Data Protection Tab​

Applies to: All targets. Enterprise edition.

The tab reads the setting as the wizard's switch does: Protect sensitive data, Enabled or Disabled. For a protected target, it also shows what is protected (the categories, or the rules by name), how it is protected, and the key. A key that was typed in is masked. A key from Vault or from an environment variable is shown by the name of the secret or the variable. Manage data protection opens the same fields as the wizard step, and needs the Target edit permission.

Two notices can appear on the tab:

  • Some directors don't send to this target — lists the directors that haven't confirmed they can protect sensitive data, with their versions, for example "edge-01 (2.4.1), edge-02 (version unknown)". These directors send nothing to this target. A director that runs an older release needs an update. A director that is offline is listed too, and receives the target again once it's back online. The notice shows only while the target is protected.
  • Protection stays on — after a downgrade to an edition without data protection, a protected target stays protected. The tab shows the setting read-only, without a Manage button. If you can edit the target, you can still turn protection off with the notice's Turn off protection button, which asks first. On that edition, protection can't be turned back on. A target that isn't protected shows the Enterprise plan card instead.

Detail Actions​

Each target detail view provides an Actions menu with the following operations:

Status Management:

  • Enable target / Disable target - Toggle target status (shown according to current status)

Advanced Operations:

  • Clone target - Duplicate configuration for new target
  • Export template - Open the target as a Bicep template, to deploy again or to change first (see Export Template)
  • Delete target - Remove target from platform

Operations​

Enable / Disable​

To change target status:

  1. Navigate to target detail view or use the Actions menu from list
  2. Click Actions menu
  3. Select Enable target or Disable target
  4. Confirmation notification confirms the status change

On the target's detail page, while some of the standalone Directors the target runs on are not connected, the notification is a warning that names them instead, for example edge-01 is not connected and applies the change when it reconnects. A cluster is never named, and a target that names no Director never warns. From the list, and for bulk actions, it is always the success notification.

Enabled targets actively forward data. Disabled targets preserve configuration but stop all forwarding.

Clone​

Duplicate an existing target configuration for quick setup:

  1. Navigate to target detail view or use Actions menu from list
  2. Click Actions menu
  3. Select Clone target
  4. System navigates to target creation wizard
  5. Pre-fills form with cloned target configuration
  6. Modify name and other settings as needed
  7. Complete wizard to create new target

A clone of a Microsoft Sentinel, Microsoft Sentinel data lake, Azure Data Explorer, Microsoft Fabric Eventhouse, Azure Blob Storage or Azure Monitor Logs target keeps the source's Director proxy: a manual proxy keeps its URL and access token, and a saved proxy stays selected.

A clone keeps the Data protection setting of the target it copies. On an edition without data protection, a clone of a protected target can't stay protected. The Data protection step then says This target will receive sensitive data, and the new target receives records as they are.

Delete​

Remove a target from the platform with dependency checking:

  1. Navigate to target detail view or use Actions menu from list
  2. Click Actions menu
  3. Select Delete target
  4. A confirmation modal appears showing the target name in its heading

Standard Deletion:

  • Click Delete to proceed (or Cancel)
  • Success notification confirms deletion. On the detail page, while some of the target's standalone Directors are not connected, it is a warning that names them, as for Enable / Disable
  • Redirect to target list view

Deletion with Dependencies:

If the target is referenced by routes, the API checks both Quick Routes and Advanced Routes and returns the list of affected routes. The modal shown depends on what is assigned:

  • Single Quick Route reference: A modal with heading "Target cannot be deleted" appears and offers a Go to routes button that navigates to the Quick Routes list.
  • Multiple references or any Advanced Route: A modal with heading "Target cannot be deleted" lists all assigned routes by name. Each Quick Route entry links to the Quick Routes list; each Advanced Route entry links to its detail page.

Dependency Resolution:

  1. Use the route links in the modal to navigate to each affected route
  2. Remove this target from the route, or delete the route
  3. Retry target deletion once all assignments are removed

Edit Mode Workflow​

Target detail tabs support inline editing with unsaved changes protection:

Enter Edit Mode:

  1. Navigate to editable tab
  2. Click the tab's Manage button, labelled with the tab's name (for example Manage Azure settings)
  3. Form fields become editable
  4. Save changes and Cancel buttons appear

Make Changes:

  • Modify editable fields
  • Changes are not saved automatically
  • Form validation occurs on save

Save Changes:

  1. Click Save changes button
  2. System validates changes
  3. Success notification displays confirmation
  4. Edit mode exits
  5. Tab displays updated values

Cancel Changes:

  1. Click Cancel button
  2. Form reverts to original values
  3. Edit mode exits
  4. No changes are saved

Leave a Tab in Edit Mode:

Leaving a tab closes its editor. With nothing changed, edit mode exits and the tab that was clicked opens; coming back means clicking Manage again. With unsaved changes, an Unsaved changes modal asks first, and the tab stays selected until it is answered:

  • Heading: "You have unsaved changes"
  • Message: "Your changes will be lost if you leave this tab without saving."
  • Continue editing - Closes the modal. The tab, the editor and the changes stay as they are
  • Discard changes - Drops the changes, closes the editor and opens the tab that was clicked

The X in the corner and the Escape key do the same as Continue editing.

Anything edited in the tab's form counts as a change, including a list-field row that is being filled in and has not been added. A value typed and then typed back still counts. When Save changes fails because a required field on another tab is empty, the page opens that tab itself, without asking, and keeps the editor and its changes.

Notifications​

The Targets interface provides automatic notifications for all operations:

Success​

Success messages auto-dismiss after 10 seconds. These include confirmations for target creation, enabling, disabling, deletion, and configuration updates. Hover to pause the auto-close timer, or click X to dismiss manually.

Errors​

Error notifications persist until manually dismissed. These include failures for enable, disable, delete, and update operations. Review error details and take corrective action before dismissing.