Skip to main content

Routes: Content Routing

Content Hub templates can include pre-built route configurations alongside pipelines. When a template includes routing, it becomes a content pack—a complete data flow configuration that combines pipeline processing with intelligent routing to multiple targets.

Content packs enable rapid deployment of vendor-specific telemetry workflows. Instead of manually creating routes after installing a pipeline template, users can install the complete solution in a single operation with pre-configured routing rules.

Content Pack Components​

A content pack includes multiple interconnected components:

ComponentDescription
PipelinePre-built processing logic for specific data sources
Required DependenciesPipelines that must be installed for the template to function
Optional DependenciesAdditional pipelines users can choose to install
Advanced RoutePre-defined routing rules with target type mappings

The route configuration within a content pack defines which target types receive processed data. During installation, users map these target types to their configured target instances.

Identifying Content Packs​

Content packs are identified in the Content Hub interface through the General Overview tab. The "This pack contains" section displays:

  • Pipeline — Always present, with a link to the Pipeline Overview tab
  • Advanced Route — Present only for content packs that include routing, with a link to the Route Overview tab

Templates without routing display only the Pipeline component.

Installation Workflows​

Content pack installation behavior depends on whether the associated pipeline is already installed.

Full Content Pack Installation​

When installing a content pack for the first time, the installation modal presents two accordion sections:

Pipeline Section:

  • Displays the main pipeline name and description
  • Lists required dependencies that must be installed
  • Shows optional dependencies with checkbox selection
  • Already-installed dependencies appear disabled with "(installed)" indicator

Advanced Route Section:

  • Checkbox to enable or disable route installation
  • Default target selection dropdown
  • Route-specific target configuration with toggles and selection dropdowns

The route section includes a checkbox that allows users to skip route installation. When unchecked, only the pipeline and its dependencies are installed. Users can install the route later using the route-only installation workflow.

Route-Only Installation​

When the pipeline is already installed but no route exists, a simplified modal appears with only the route configuration options. This scenario occurs when:

  • A pipeline was previously installed without its route component
  • Users chose to skip route installation during initial content pack setup
  • The content pack was updated to include routing after initial pipeline installation

Access the route-only installation through the Actions menu by selecting Install route.

Configuring Target Mappings​

Content pack routes define target types rather than specific target instances. During installation, users map these types to their actual configured targets.

Default Target Selection​

Every route requires a default target for events that don't match specific routing rules. The dropdown displays:

  • Null — Special option that discards unmatched events (no output)
  • All active targets configured in the system

Select the appropriate default target based on your data retention and routing requirements.

Route-Specific Targets​

Content packs define target types based on the intended use case. Common target types include:

  • Microsoft Sentinel — Azure security analytics
  • Sentinel Data Lake — Long-term Azure storage
  • Azure Data Explorer — Analytics queries
  • Azure Blob Storage — Object storage
  • Elasticsearch — Search and analytics
  • Elastic Security — Security analytics
  • Splunk — Log analytics
  • Splunk Security — Splunk Enterprise Security

For each target type defined in the content pack:

  1. Toggle — Enable or disable sending data to this target type
  2. Target Dropdown — Select the specific target instance (filtered to matching type)

When a toggle is enabled, selecting a target instance is required. The dropdown only shows targets matching the expected type.

Advanced Configuration​

Content pack routes include pre-configured advanced settings in the conf section:

  • Smart Routing — Intelligent routing based on data characteristics
  • Allowed Tables — List of normalized table types (ASIM, Defender, etc.)
  • Per-Target Settings — Individual configuration for each target type
  • Optimization — Sampling and filtering options

These settings are applied automatically based on the content pack design. Users can modify them after installation through the route detail view.

Route Overview Tab​

Content packs with routing include a Route Overview tab in the Content Hub detail view. This tab displays:

Route Information:

  • Route name and description
  • Associated pipelines
  • Filter expression (if defined)
  • Scheduling configuration (Disabled by default)

Advanced Configuration Settings:

  • Defined targets — List of target types this route supports

YAML Configuration:

  • Read-only Monaco editor displaying the complete route configuration
  • Shows the conf section with all advanced settings

Post-Installation​

After successful content pack installation, users receive a success confirmation with links to:

  • Installed pipeline — Navigate to Pipeline detail page
  • Installed route — Navigate to Routes Advanced Routes detail page (if route was installed)

Viewing Installed Routes​

Installed content routes appear in Home > Routes alongside manually-created routes. Content routes display with the same information:

  • Route name (matches content pack route name)
  • Status (Active/Passive)
  • Director assignments
  • Pipeline reference
  • Default target

Managing Content Routes​

Content routes support the same management operations as manually-created advanced routes:

  • View Details — See full configuration including target mappings
  • Edit — Modify target mappings, filters, scheduling, or other settings
  • Activate/Deactivate — Toggle route processing status
  • Delete — Remove the route (preserves the installed pipeline)

Access installed routes through the Content Hub detail page using the Actions menu and selecting See installed route.

Integration with Content Hub​

Content routing extends the Content Hub template system to provide complete data flow configurations.

Template Updates​

When a content pack receives updates, both pipeline and route configurations may be updated. The template update workflow allows reviewing and selectively accepting changes while preserving custom modifications to target mappings and other settings.

Relationship to Pipelines​

Content routes reference their associated content pack pipelines. The route processes data through the pipeline before routing to configured targets. Uninstalling the pipeline may affect route operation.