Data Connectors Reference

This connector receives data from external security systems that push logs to Microsoft Sentinel. The external system must be configured to send raw event data to the Microsoft Sentinel Ingestion API. Clicking on Deploy will trigger the creation of Log Analytics tables and a Data Collection Rule (DCR). It will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token.

Learn more about the connector setup processLearn more about the connector setup process

Azure Resource Deployment

Setup Instructions:

Airlock Digital (Poll - SaaS)

Supported by:Airlock Digital

The Airlock DigitalSaaS connector periodically pulls execution history and server activity logs from the Airlock Digital SaaS API, authenticating with a user API key together with your directory and tenant identifiers. It is the polling connector for Airlock Digital's hosted SaaS offering, and it does not collect policy change logs. For self-hosted servers or Airlock Digital SaaS running v7.0 or higher, the Airlock Digital (Push) connector delivers events in near real time and also collects policy changes. For self-hosted servers older than v7.0, use the Airlock Digital (Poll) connector.

NOTE: Use one connector per Airlock Digital server. If the same server is collected by more than one Airlock Digital connector, duplicate data is populated in the tables.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Airlock Digital SaaS API credentials: A user API key, directory ID, and tenant ID for your Airlock Digital SaaS instance.

Setup Instructions:

Configure access to the Airlock Digital SaaS API

Set up API access in your Airlock Digital SaaS tenant before connecting.

Your server URL comes from your portal address: take https://portal.au.YourDomain.com/tenant/XYZ/dashboard and drop the portal. prefix and everything after the top-level domain, leaving https://au.YourDomain.com.

The user API key, directory ID and tenant ID are in Airlock Digital under User Menu > My Profile.

Logs are polled every five minutes.

Connect Airlock Digital SaaS instances to Microsoft Sentinel

This connector supports multiple simultaneous connections. Add one connection per Airlock Digital SaaS instance; each connection ingests the selected data types in parallel. Use the grid below to review existing connections or add a new one.

• Data Connectors Grid (configure in portal)

Airlock Digital (Poll)

Supported by:Airlock Digital

The Airlock DigitalPoll connector periodically pulls execution history and server activity logs from the REST API of a self-hosted Airlock Digital server, authenticating with a user API key. It is intended for servers older than v7.0 that do not support push-based logging, and it does not collect policy change logs. For self-hosted servers or Airlock Digital SaaS running v7.0 or higher, the Airlock Digital (Push) connector delivers events in near real time; for Airlock Digital SaaS, the Airlock Digital (Poll - SaaS) connector is also available.

NOTE: Use one connector per Airlock Digital server. If the same server is collected by more than one Airlock Digital connector, duplicate data is populated in the tables.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Airlock Digital API key: An API key for your Airlock Digital server.

Setup Instructions:

Configure access to the Airlock Digital API

Set up API access on your Airlock Digital server before connecting.

The Airlock Digital REST API listens on port 3129 by default, so your server URL looks like https://airlock.company.com:3129. The server must be reachable from Azure.

Create an API key in Airlock Digital under User Menu > My Profile > API Keys.

Logs are polled every five minutes.

Connect Airlock Digital servers to Microsoft Sentinel

This connector supports multiple simultaneous connections. Add one connection per Airlock Digital server; each connection ingests the selected data types in parallel. Use the grid below to review existing connections or add a new one.

• Data Connectors Grid (configure in portal)

Airlock Digital (Push)

Supported by:Airlock Digital

The Airlock DigitalPush connector streams execution history, server activity, and policy change logs into Microsoft Sentinel in near real time. It supports both self-hosted servers and Airlock Digital SaaS running v7.0 or higher. Events are pushed by Airlock's external logging feature as they occur, so there is no polling delay, and authentication uses a Microsoft Entra application. This is the recommended connector for Airlock Digital v7.0 and higher. For self-hosted servers older than v7.0, use the Airlock Digital (Poll) connector.

NOTE: Use one connector per Airlock Digital server. If the same server is collected by more than one Airlock Digital connector, duplicate data is populated in the tables.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Microsoft Entra: Permission to create an app registration in Microsoft Entra ID. Typically requires the Application Developer role or higher.
• Microsoft Azure: Permission to assign the Monitoring Metrics Publisher role on the data collection rule. Typically requires Owner or User Access Administrator.

Setup Instructions:

1. Deploy the push resources

This step provisions the data collection rule, custom table, and Microsoft Entra application that Airlock uses to send logs into Microsoft Sentinel.

Note: The Client Secret is never stored. It is shown only once, right after you select Deploy, and the connector page may clear it within a few seconds, so use the copy icon beside the field to copy it immediately. If you miss it, open Microsoft Entra ID > App registrations, select the app named Airlock Digital Log Push OAuth, go to Certificates & secrets, create a new client secret, and copy its value. There it stays visible until you leave that page.

2. Configure Airlock external logging

On your Airlock Digital server, go to Settings > Logging > External Logging and add a Microsoft Sentinel CEF - HTTP(S) log receiver using the values below.

• Tenant ID: <variable value provided at install time>
• Application (Client) ID: <variable value provided at install time>
• Client Secret: <variable value provided at install time>
• Data Collection Endpoint URI: <variable value provided at install time>
• DCR Immutable ID: <variable value provided at install time>
• Stream Name: <variable value provided at install time>

Airlock Digital connector (via Codeless Connector Framework)

Supported by:Microsoft Corporation

• Workspace ID: <variable value provided at install time>
• Primary Key: <variable value provided at install time>

Akamai Guardicore

Supported by:Akamai Guardicore Support

The Akamai Guardicore connector uses the Codeless Connector Framework (CCF) to import Agents, Assets, Applications, and Policy Rules from a Guardicore Centra instance into Microsoft Sentinel via Data Collection Rule (DCR) ingestion. The connector polls every 10 minutes via Microsoft Sentinel's CCF runtime; no Azure Function App is deployed.

Log Analytics table(s):

Data collection rule support: Not currently supported

Setup Instructions:

Connect Akamai Guardicore to Microsoft Sentinel

Prerequisites

1. You must have a reachable Akamai Guardicore Centra management instance with API access enabled.
2. Create (or obtain) an API user in Guardicore Centra with the Read-only role. This account must be authorized to call /api/v3.0/authenticate, /api/v3.0/agents, /api/v3.0/assets, /api/v3.0/workflow/projects, and /api/v3.0/visibility/policy/rules.
3. Have the Guardicore management URL (for example https://<tenant>.cloud.guardicore.com) and the service-account username and password ready.
4. The connector polls every 10 minutes via Microsoft Sentinel's CCF runtime. No Azure Function App is deployed.

Provide your Guardicore Centra service-account details and click Connect to start polling.

• Guardicore Management URL: (https://<tenant>.cloud.guardicore.com)
• Guardicore Username: (service-account username)
• Guardicore Password: (service-account password)
• Enable/Disable Connection

Akamai Security Events (via Codeless Connector Framework)

Supported by:Microsoft Corporation

• AWS CloudTrail
• VPC Flow Logs
• AWS GuardDuty
• AWSCloudWatchAWS CloudWatch

For more information, see the Microsoft Sentinel documentation.

There is no need to deploy any custom infrastructure.

Enter the information into the ARGOS SentinelARGOS Sentinel configuration page.

New detections will automatically be forwarded.

Learn more about the integration

• Workspace ID: <variable value provided at install time>
• Primary Key: <variable value provided at install time>

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

1. Once all application settings have been entered, click Save.

Atlassian Beacon Alerts

Supported by:DEFEND Ltd.

Atlassian Beacon is a cloud product that is built for Intelligent threat detection across the Atlassian platforms (Jira, Confluence, and Atlassian Admin). This can help users detect, investigate and respond to risky user activity for the Atlassian suite of products. The solution is a custom data connector from DEFEND Ltd. that is used to visualize the alerts ingested from Atlassian Beacon to Microsoft Sentinel via a Logic App.

Log Analytics table(s):

Data collection rule support: Not currently supported

Setup Instructions:

1. Microsoft Sentinel

1. Navigate to the newly installed Logic App 'Atlassian Beacon Integration'
2. Navigate to 'Logic app designer'
3. Expand the 'When a HTTP request is received'
4. Copy the 'HTTP POST URL'

2. Atlassian Beacon

1. Login to Atlassian Beacon using an admin account
2. Navigate to 'SIEM forwarding' under SETTINGS
3. Paste the copied URL from Logic App in the text box
4. Click the 'Save' button

3. Testing and Validation

1. Login to Atlassian Beacon using an admin account
2. Navigate to 'SIEM forwarding' under SETTINGS
3. Click the 'Test' button right next to the newly configured webhook
4. Navigate to Microsoft Sentinel
5. Navigate to the newly installed Logic App
6. Check for the Logic App Run under 'Runs history'
7. Check for logs under the table name 'atlassian_beacon_alerts_CL' in 'Logs'
8. If the analytic rule has been enabled, the above Test alert should have created an incident in Microsoft Sentinel

Atlassian Confluence Audit (via Codeless Connector Framework)

Supported by:Microsoft Corporation

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

1. Install and onboard the Microsoft agent for Windows.

Learn about agent setupagent setup and windows events onboarding.

You can skip this step if you have already installed the Microsoft agent for Windows

To enable AWS Security Hub Connector for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect.

• SentinelRoleArn: (The AWS IAM Role ARN for cross-account access (e.g., arn:aws:iam::123456789012:role/SentinelRole))
• SentinelSQSQueueURL: (The full AWS EKS queue URL (for example, https://sqs.region.amazonaws.com/account-id/queue-name(e.g., https://sqs.region.amazonaws.com/account-id/queue-name))

3. Connect

Prerequisites:

• Azure DevOps Prerequisite: Please ensure the following: 1. Register an Entra App in Microsoft Entra Admin Center under App Registrations. 2. In 'API permissions' - add Permissions to 'Azure DevOps - vso.auditlog'. 3. In 'Certificates & secrets' - generate 'Client secret'. 4. In 'Authentication' - add the Redirect URI found below in the corresponding field. 5. In the Azure DevOps settings - enable audit log and set View audit log for the user. Azure DevOps AuditingAzure DevOps Auditing. 6. Ensure the user assigned to connect the data connector has the View audit logs permission explicitly set to Allow at all times. This permission is essential for successful log ingestion. If the permission is revoked or not granted, data ingestion will fail or be interrupted.

Setup Instructions:

• Token Endpoint: ([concat(variables('_loginUrl'), '/{TenantId}/oauth2/v2.0/token')])
• Authorization Endpoint: ([concat(variables('_loginUrl'), '/{TenantId}/oauth2/v2.0/authorize')])
• API Endpoint: (https://auditservice.dev.azure.com/{organizationName}/_apis/audit/auditlog?api-version=7.2-previewhttps://auditservice.dev.azure.com/{organizationName}/_apis/audit/auditlog?api-version=7.2-preview)

Azure Event Hub

Data collection rule support: Not currently supported

BETTER Mobile Threat Defense (MTD)

Supported by:Better Mobile Security Inc.

The BETTER MTD Connector allows Enterprises to connect their Better MTD instances with Microsoft Sentinel, to view their data in Dashboards, create custom alerts, use it to trigger playbooks and expands threat hunting capabilities. This gives users more insight into their organization's mobile devices and ability to quickly analyze current mobile security posture which improves their overall SecOps capabilities.

Log Analytics table(s):

Data collection rule support: Not currently supported

Setup Instructions:

1. In Better MTD Console, click on Integration on the side bar.
2. Select Others tab.
3. Click the ADD ACCOUNT button and Select Microsoft Sentinel from the available integrations.
4. Create the Integration:

• set ACCOUNT NAME to a descriptive name that identifies the integration then click Next
• Enter your WORKSPACE ID and PRIMARY KEY from the fields below, click Save
• Click Done

1. Threat Policy setup (Which Incidents should be reported to Microsoft Sentinel):

• In Better MTD Console, click on Policies on the side bar
• Click on the Edit button of the Policy that you are using.
• For each Incident types that you want to be logged go to Send to Integrations field and select Sentinel

1. For more information, refer to the vendor documentation.

• Workspace ID: <variable value provided at install time>
• Primary Key: <variable value provided at install time>

BeyondTrust PM Cloud

Supported by:BeyondTrust

Your API key can be found in the Bitwarden organization admin console. Please see Bitwarden documentation for more information. Self-hosted Bitwarden servers may need to reconfigure their installation's URL.

• Bitwarden Identity Url: (https://identity.bitwarden.comhttps://identity.bitwarden.com)
• Bitwarden Api Url: (https://api.bitwarden.comhttps://api.bitwarden.com)

blacklens.io

After a few minutes, a test incident should appear in Microsoft Sentinel.

BloodHound Enterprise Data Connector (using Azure Functions)

Supported by:SpecterOps

BloodHound Enterprise from SpecterOps is an Identity Attack Path Management platform: it maps how attackers can move through identity relationships to reach critical assets so teams can prioritize and remediate those paths not only detect them. It brings clarity to identity sprawl in Active Directory, Azure, and beyond, including Privilege Zone style protection around what matters most in your environment.

This Microsoft Sentinel connector adds BloodHound Enterprise attack path context into your workspace alongside logs and alerts so you can enrich investigations, focus on high-value findings, and track exposure, audit activity, and Tier Zero assets in one place.

What this connector does

• Connects to the BloodHound Enterprise REST API using your configured credentials (see Working with the API) and runs on a schedule you set when the Azure Function is deployed. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. For more information, see Azure Functions.
• BloodHound Enterprise API access: Token ID, Token key, and your tenant base URL are required to authenticate to the BloodHound Enterprise REST API (requests are signed per the SpecterOps API model see Working with the API).

Setup Instructions:

Step 1. Create BloodHound Enterprise API credentials

In your BloodHound Enterprise tenant, create API credentials (Token ID and Token key) used to sign requests to the REST API. Follow Working with the API to create API credentials then store the values securely.

Step 2. Create Microsoft Entra application

Create a Microsoft Entra ID (Azure AD) application used for ingestion to Log Analytics (for example DCE/DCR-related access). Follow Create a Microsoft Entra application to create Microsoft Entra application & its credentials then save Application (client) ID, Client secret value, and any other IDs your administrator requires. Store the client secret securely.

Step 3. Deploy Function App

NOTE: This connector uses Azure Functions to pull data from BloodHound Enterprise into Microsoft Sentinel. This might result in additional data ingestion costs. Check the Azure Functions pricing page for details.

IMPORTANT: Before deploying the BloodHound Enterprise connector, have the Workspace name (see below), BloodHound Enterprise tenant URL, Token ID and Token key, Microsoft Entra Application (client) ID and client secret, and your desired environment and finding type filters (or use template defaults such as All) ready.

• Workspace Name: <variable value provided at install time>

Deploy all the resources related to the data connector

1. Click the Deploy to Azure button below.

   aka.ms

2. Select the preferred Subscription, Resource Group, and Location.

3. Enter Function App name, Log Analytics workspace name (Microsoft Sentinel workspace), BloodHound Enterprise tenant domain (URL), BloodHound Token ID and Token key (secure parameters), Microsoft Entra Application (client) ID, and Microsoft Entra application client secret.

4. Optional: set Lookup days (historical lookback), Selected BloodHound environments (comma-separated or All), and Selected finding types (or All) as described in the template.

5. Click Review + create, then Create to deploy.

Box Events (via Codeless Connector Framework)

Supported by:Microsoft Corporation

• API Key: (Enter API key)
• Enable/Disable Connection

Cato Networks Events (Push)

Supported by:Cato Networks

The Cato Networks connector pushes security and networking telemetry from the Cato Management Application into Microsoft Sentinel in near real time, using the Codeless Connector Framework (CCF) Push pattern. Data lands in a custom Log Analytics table, ready for hunting, analytics, and visualization. See the Cato Event Schema for the fields carried on each record.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Microsoft Entra: Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher.
• Microsoft Azure: Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role.
• Cato Management Application: An administrator account on the Cato Management Application with permission to create a Microsoft Sentinel data-out connector.

Setup Instructions:

1. Create ARM Resources and Provide the Required Permissions

This connector enables the Cato Cloud to push events directly to Microsoft Sentinel via the Azure Monitor Logs Ingestion API.

Automated Configuration and Secure Data Ingestion with Entra Application Clicking on "Deploy" will trigger the creation of a Log Analytics table and a Data Collection Rule (DCR). It will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token.

One connector per workspace

The Data Collection Rule and the CatoNetworksEvents_CL table are named from this workspace, so deploying the connector again in the same Log Analytics workspace reuses them rather than creating a second set. A workspace holds one Cato connector.

Events from more than one Cato account can be sent to the same connector; they share the table and are distinguished by account_id and account_name. To keep feeds in separate tables, with their own retention or access control, use a separate Log Analytics workspace for each.

2. Configure the connector in the Cato Management Application

In the Cato Management Application, go to Resources > Integrations > Configured Integrations, click New, select Microsoft Sentinel, and enter the values below. For full setup instructions, see Integrating Cato Events with Microsoft Sentinel.

• Tenant ID (Directory ID): <variable value provided at install time>
• Entra App Registration Application ID: <variable value provided at install time>
• Entra App Registration Secret: <variable value provided at install time>
• Data Collection Endpoint Uri: <variable value provided at install time>
• Data Collection Rule Immutable ID: <variable value provided at install time>
• Events Stream Name: <variable value provided at install time>

3. Keeping the schema up to date

Cato periodically adds fields to its event schema. Because upgrading this solution leaves your connector's existing custom table and Data Collection Rule unchanged, new fields must be applied separately using the dedicated schema update template.

Apply the current schema

Deploy the schema update

Select the subscription and the resource group holding this workspace, then enter the workspace name. That is the only value you supply.

Your ingestion URL, Entra application and client secret are unchanged, and nothing has to be re-entered in the Cato Management Application. Ingestion continues throughout.

Allow up to 30 minutes for new fields to start arriving. Events are still accepted during that window and the new fields are simply empty, so confirm with a query rather than assuming a failure.

Cayosoft Guardian Threat Alerts

Supported by:Cayosoft Support

The Cayosoft Guardian data connector automatically ingests threat alerts from Cayosoft Guardian into Microsoft Sentinel. Cayosoft Guardian writes threat alerts to the Windows Event Log as Event ID 2. The Azure Monitor Agent (AMA) collects these events by using Data Collection Rules (DCRs) and sends the parsed data to the custom Log Analytics table named CayosoftThreatAlerts_CL. After the data is ingested, Microsoft Sentinel can use it for monitoring, analytics, incident creation, investigation, and automated response across your hybrid identity environment.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Cayosoft Guardian Server: Must be connected to Azure Arc or run as an Azure virtual machine, with the Azure Monitor Agent installed.
• Data Collection Rules: Read and write permissions for Data Collection Rules are required to associate the Data Collection Rule with the Azure Arc-enabled server or Azure virtual machine that runs Cayosoft Guardian.

Setup Instructions:

1. Prerequisites and Infrastructure Setup

Before configuring the integration, make sure the following requirements are met:

• You have a Microsoft Sentinel workspace.
• The Windows Server that hosts Cayosoft Guardian is connected to Azure Arc or runs as an Azure virtual machine.
• The Azure Monitor Agent (AMA) is installed on the Cayosoft Guardian server.

2. Deploy the Data Collection Rule (DCR)

Cayosoft Guardian streams threat alerts via the Azure Monitor Agent, which requires a Data Collection Rule (DCR) linked to your Arc-enabled server or Azure VM. This is a one-time deployment, separate from the solution install.

1. Click the button below.

   portal.azure.com

2. Select your Subscription, Resource Group, and Region.

3. Enter your Workspace Name (the Microsoft Sentinel-enabled Log Analytics workspace) and Arc Machine Name (the exact name of the Arc-enabled server or Azure VM running Cayosoft Guardian).

4. Click Review + Create, then Create.

3. Configure Cayosoft Guardian Logging

Enable the event log generation within the product:

1. Open Cayosoft Guardian.
2. Navigate to Settings > Service Settings > Windows Event Log Settings.
3. Verify that Windows Event Log for Alerts is enabled. Cayosoft Guardian writes threat alerts to the Windows Event Log > Applications and Services Logs > Cayosoft Guardian Alerts

4. Install the Workbook

The Cayosoft Guardian solution includes a prebuilt workbook that visualizes threat alerts and incidents, including severity distribution, alerts by system type, alert trends over time, and recent incidents and alerts.

1. In Microsoft Sentinel, go to Content hub.
2. Search for Cayosoft Guardian and verify that the solution is installed. If it is not installed, install it.
3. Go to Workbooks and select the Templates tab.
4. Select Cayosoft Guardian - Incidents Dashboard, click Save, choose the Azure region where you want to save the workbook, and then click View saved workbook.
5. The workbook is available under My workbooks. Optionally, pin it to an Azure dashboard for quick access.

5. Enable the Analytics Rules

The Cayosoft Guardian solution also includes scheduled analytics rule templates that convert Cayosoft Guardian threat alerts into Microsoft Sentinel incidents.

1. In Microsoft Sentinel, go to Analytics.
2. Select the Rule templates tab.
3. Locate the Cayosoft Guardian analytics rule templates, for example:
   • Cayosoft Guardian - Cloud Application Security Threats
   • Cayosoft Guardian - Core Identity and Infrastructure Threats
4. Click Create rule, review the schedule, entity mapping, and incident settings, and then click Review + Create.
5. Verify that the rule appears as Enabled on the Active rules tab. The analytics rules generate the SecurityIncident records used by the workbook's Incidents & recent alerts table.

6. Verify the Integration

After configuring the connector, verify that Microsoft Sentinel is receiving Cayosoft Guardian threat alert data:

1. In Microsoft Sentinel, open the Log Analytics workspace connected to your Microsoft Sentinel instance.
2. Open Logs.
3. Run the following query:CayosoftThreatAlerts_CL | sort by TimeGenerated desc | take 50
4. Confirm that new rows are available in the table. For detailed information, step-by-step guides, and known issues, please refer to the official documentation.

Check Point CloudGuard CNAPP Connector for Microsoft Sentinel

Supported by:Check Point

The CloudGuard data connector enables the ingestion of security events from the CloudGuard API into Microsoft Sentinel™, using Microsoft Sentinel’s Codeless Connector Framework. The connector supports DCR-based ingestion time transformations which parses incoming security event data into custom columns. This pre-parsing process eliminates the need for query-time parsing, resulting in improved performance for data queries.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• CloudGuard API Key: Refer to the instructions provided here to generate an API key.

Setup Instructions:

Connect CloudGuard Security Events to Microsoft Sentinel

To enable the CloudGuard connector for Microsoft Sentinel, enter the required information below and select Connect.

• API Key ID: (api_key)
• API Key Secret: (api_secret)
• CloudGuard Endpoint URL: (e.g. https://api.dome9.com)
• Filter: (Paste filter from CloudGuard)
• Enable/Disable Connection

Check Point Cyberint Alerts Connector (via Codeless Connector Framework)

Supported by:Check Point

Cyberint, a Check Point company, provides a Microsoft Sentinel integration to streamline critical Alerts and bring enriched threat intelligence from the Infinity External Risk Management solution into Microsoft Sentinel. This simplifies the process of tracking the status of tickets with automatic sync updates across systems. Using this new integration for Microsoft Sentinel, existing Cyberint and Microsoft Sentinel customers can easily pull logs based on Cyberint's findings into Microsoft Sentinel platform.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Check Point Cyberint API Key, Argos URL, and Customer Name: The connector API key, Argos URL, and Customer Name are requiredrequired. Include CSV Attachments as JSON is optional.

Setup Instructions:

Connect Checkpoint Cyberint Alerts to Microsoft Sentinel

To enable the connector provide the required information below and click on Connect.

Argos URL — Cyberint API URL for your tenant (e.g. https://your_tenant.cyberint.io) API Token — Cyberint API access token Customer Name — Company (client) name associated with your Cyberint instance Environments — Comma-separated list of environments to fetch. If empty, all environments are fetched.\n\nSeverity — Comma-separated list of severities to fetch (low, medium, high, very_high). If empty, all severities are fetched.\n\n Environments — Comma-separated list of environments to fetch (e.g. Production,Staging). If empty, all environments are fetched. Polling Interval — How often to poll for new alerts, in minutes (default: 5)\n\nInclude CSV Attachments as JSON — Whether to include CSV attachments as JSON content in alerts (default: false)

• Argos URL: (https://your_tenant.cyberint.io)
• API Token: (Cyberint API access token)
• Customer Name: (Company (client) name associated with your Cyberint instance)
• Environments: (Comma-separated list (e.g. Production,Staging))
• Severity: (Comma-separated list (e.g. low,medium,high,very_high))
• Environments: (Comma-separated list)
• Polling Interval (Minutes): (Polling frequency in minutes)
• Include CSV Attachments as JSON: (true or false)
• Enable/Disable Connection

Check Point Cyberint IOC Connector

Supported by:Check Point

Cyberint, a Check Point company, provides a Microsoft Sentinel integration to ingest Indicators of Compromise (IOCs) from the Infinity External Risk Management solution into Microsoft Sentinel. This connector automatically pulls the daily IOC feed — including malicious IPs, domains, URLs, and file hashes — enriched with threat context such as severity, confidence, and detected activity.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Check Point Cyberint API Key, Argos URL, and Customer Name: The connector API key, Argos URL, and Customer Name are required

Setup Instructions:

Connect Check Point Cyberint IOC Feed to Microsoft Sentinel

To enable the connector provide the required information below and click on Connect.

Argos URL — Cyberint API URL for your tenant (e.g. https://your_tenant.cyberint.io) API Token — Cyberint API access token Customer Name — Company (client) name associated with your Cyberint instance

• Argos URL: (https://your-company.cyberint.io)
• API Token: (API Token)
• Customer Name: (Company (client) name associated with your Cyberint instance)
• Enable/Disable Connection

Check Point EM ThreatCloud Intelligence Feed Connector

Supported by:Check Point

Check Point provides a Microsoft Sentinel integration to ingest high-fidelity Indicators of Compromise (IoCs) from the Infinity External Risk Management solution into Microsoft Sentinel. This connector incrementally pulls the premium IOC feed — including malicious IPs, domains, URLs, and file hashes — enriched with confidence, severity, malicious classification, kill chain stage, blocking and uniqueness flags, malware types, and CVE/campaign associations.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Check Point Cyberint API Key, Argos URL, and Customer Name: The connector API key, Argos URL, and Customer Name are required

Setup Instructions:

Connect Check Point EM ThreatCloud Intelligence Feed to Microsoft Sentinel

To enable the connector provide the required information below and click on Connect.

Argos URL — Cyberint API URL for your tenant (e.g. https://your_tenant.cyberint.io) API Token — Cyberint API access token Customer Name — Company (client) name associated with your Cyberint instance

• Argos URL: (https://your-company.cyberint.io)
• API Token: (API Token)
• Customer Name: (Company (client) name associated with your Cyberint instance)
• Enable/Disable Connection

Check Point Email Security (via Codeless Connector Framework)

Supported by:Microsoft Corporation

The Check Point Email Security (Harmony Email Collaboration) data connector provides the capability to ingest security events and audit logs from Check Point's Email Security platform into Microsoft Sentinel through the REST API. The connector provides visibility into advanced email threats including zero-day threats, phishing, account takeover, data leakage, and shadow IT discovery. It ingests security events, anti-phishing exceptions, spam exceptions, and audit logs into Microsoft Sentinel, helping organizations maintain security and compliance visibility.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Check Point Email Security API Credentials: Two separate Check Point Infinity Portal API keys are required. A Harmony Email & Collaboration API key (Client ID + Client Secret) is used for security events and exceptions. A separate Logs as a Service API key (Audit Client ID + Audit Client Secret) is required for audit logs. Generate both from your Check Point Infinity Portal under Global Settings > API Keys.

Setup Instructions:

Connect Check Point Email Security to Microsoft Sentinel

To gather data from Check Point Email Security, you need to provide the following credentials:

1. API Base URL - The base URL for your Check Point Email Security tenant (region-specific).

2. Client ID - Client ID of the Harmony Email & Collaboration API key (used for security events and exceptions).

3. Client Secret - Secret (access key) of the Harmony Email & Collaboration API key.

4. Audit Client ID - Client ID of a separate Logs as a Service API key (used for audit logs).

5. Audit Client Secret - Secret (access key) of the Logs as a Service API key.

To obtain these credentials, log in to your Check Point Infinity Portal and navigate to the API Keys section under Global Settings. Create one API key with the Harmony Email & Collaboration service for the Client ID/Secret, and a second API key with the Logs as a Service service for the Audit Client ID/Secret.

Multi-tenant support: This connector supports ingesting data from multiple Check Point Email Security tenants in parallel. Click Add Connection once per tenant, supplying that tenant's API Base URL and credentials - each connection is tracked and managed independently in the grid below.

1. Once all application settings have been entered, click Save.

Cisco Duo Security (using Azure Functions)Activity Logs

Supported by:Cisco Systems

The Cisco Duo SecurityActivity Logs connector ingests admin and user activity log data connector provides the capability to ingest authentication logs, administrator logs, telephony logs, offline enrollment logs and Trust Monitor events into Microsoft Sentinel usingfrom the Cisco Duo Admin API. Refer to API documentation forAPI into Microsoft Sentinel.

Activity logs capture admin panel actions such as user creation, modification, deletion, admin logins, and configuration changes.

Supports HMAC-based API Key authentication (Integration Key and Secret Key).

For more information.information, visit Cisco Duo Admin API Docs.

Log Analytics table(s):

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

• Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. For more information, see Azure Functions.
• Cisco Duo API credentialsKey: A Cisco Duo Integration Key and Secret Key are required. These are obtained by creating an Admin API credentialsapplication in the Duo Admin Panel with permission 'Grant read log is required for Cisco Duo API. See the documentation to learn more about creating Cisco Duo API credentials.' permission. See documentation.

Setup Instructions:

NOTE: This connector uses Azure FunctionsConnect Cisco Duo Activity Logs to connect toMicrosoft Sentinel

To enable the Cisco Duo Activity Logs connector, provide your Duo Admin API credentials below.

1. Log in to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the Azure Functions pricing page for details.

Duo Admin Panel.

• Integration Key Vault. Azure(ikey): (DIXXXXXXXXXXXXXXXXXX)
• Secret Key Vault provides a secure mechanism to store and retrieve key values. Follow these instructions to use Azure Key Vault with an Azure Function App.(skey): (your_secret_key)
• API Base URL: (https://api-XXXXXXXX.duosecurity.com)
• Enable/Disable Connection

Cisco Duo Authentication

NOTE:Supported by: ThisCisco Systems

The Cisco Duo connector ingests authentication log data connector depends on a parser based on a Kusto Function to work as expected CiscoDuo which is deployed withfrom the Microsoft Sentinel Solution.

STEP 1 - Obtaining Cisco Duo Admin API credentialsinto Microsoft Sentinel.

Supports HMAC-based API Key authentication (Integration Key and Secret Key).

For more information, visit Cisco Duo Admin API Docs.

Log Analytics table(s):

Table	DCR support	Lake-only ingestion
DuoAuthentication_CL	Yes	Yes

Data collection rule support:Workspace transform DCR

Prerequisites:

• Follow the instructions to obtain integration key, secret key,Cisco Duo API Key: A Cisco Duo Integration Key and Secret Key are required. These are obtained by creating an Admin API hostname. Use Grant read log permissionapplication in the 4th step of the instructionsDuo Admin Panel. See documentation.

STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function

IMPORTANT: Before deploying the data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as Azure Blob Storage connection string and container name, readily available.

• Workspace ID: <variable value provided at install time>
• Primary Key: <variable value provided at install time>

Option 1 - Azure Resource Manager (ARM) TemplateSetup Instructions:

Use this method for automated deployment of the data connector using an ARM Template.

1. Click the Deploy to Azure button below.

   aka.msaka.ms

2. Select the preferred Subscription, Resource Group and Location.

3. Enter the Cisco Duo Integration Key, Cisco Duo Secret Key, Cisco Duo API Hostname, Cisco Duo Log Types, Microsoft Sentinel Workspace Id, Microsoft Sentinel Shared Key

4. Mark the checkbox labeled I agree to the terms and conditions stated above.

5. Click Purchase to deploy.

Option 2 - Manual Deployment of Azure Functions

Use the following step-by-step instructions to deploy the data connector manually with Azure Functions (Deployment via Visual Studio Code).

Step 1 - Deploy a Function AppObtain Cisco Duo Admin API credentials

1. DownloadLog in to the Azure Function App file. Extract archiveCisco Duo Admin Panel.
2. Navigate to your local development computer.Applications and click Protect an Application.
3. FollowSearch for Admin API and click Protect.
4. Copy the function app manual deployment instructions to deployAPI Hostname, Integration Key, and Secret Key.
5. Ensure the Azure Functions app using VSCode.
6. After successful deployment of the function app, follow next steps for configuring it.application has Grant read log permission enabled.

Step 2 - ConfigureConnect Cisco Duo to Microsoft Sentinel

Enter your Cisco Duo Admin API credentials below to begin ingesting authentication logs.

• API Base URL: (https://api-XXXXXXXX.duosecurity.com)
• Integration Key (Username): (Enter your Duo Integration Key)
• Secret Key (Password): (Enter your Duo Secret Key)
• Enable/Disable Connection

Cisco Duo Telephony Logs

Supported by:Cisco Systems

The Cisco Duo Telephony Logs connector ingests SMS and phone-call authentication event data from the Function AppCisco Duo Admin API into Microsoft Sentinel.

Telephony logs record every instance where Duo sends an SMS passcode or places a phone callback during an authentication, enrollment, or administrator bypass workflow. Each event includes the phone number, channel used (sms or phone), context, and number of telephony credits consumed.

Supports HMAC-based API Key authentication (Integration Key and Secret Key).

For more information, visit Cisco Duo Admin API Docs.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Cisco Duo API Key: A Cisco Duo Integration Key and Secret Key are required. These are obtained by creating an Admin API application in the Duo Admin Panel with 'Grant read log' permission. See documentation.

Setup Instructions:

Connect Cisco Duo Telephony Logs to Microsoft Sentinel

To enable the Cisco Duo Telephony Logs connector, provide your Duo Admin API credentials below.

1. InLog in to the Function App, select the Function App Name and selectDuo Admin Panel.
2. Navigate to ConfigurationApplications > Protect an Application.
3. In theFind Application settings tab, select + New application settingAdmin API and click Protect.
4. Add each ofEnsure the following application settings individually, with their respective string values (case-sensitive): CISCO_DUO_INTEGRATION_KEY CISCO_DUO_SECRET_KEY CISCO_DUO_API_HOSTNAME CISCO_DUO_LOG_TYPES WORKSPACE_ID SHARED_KEY logAnalyticsUri (Optional)has Grant read log permission enabled.
5. Copy the Integration Key, Secret Key, and API Hostname and enter them below.

• Use logAnalyticsUri to override the log analytics Integration Key (ikey): (DIXXXXXXXXXXXXXXXXXX)
• Secret Key (skey): (your_secret_key)
• API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: https://WORKSPACE_ID.ods.opinsights.azure.us.Base URL: (https://api-XXXXXXXX.duosecurity.com)
• Enable/Disable Connection

1. Once all application settings have been entered, click Save.

Cisco Email Threat Defense (ETD)

Data collection rule support:Workspace transform DCR

1. Configuration of the Cisco Cloud Security Logs Collection

NOTE: This connector has been updated to support Cisco Cloud Security log schema version 16.

NOTE: You must enable optional headers in the Cisco dashboard for this connector to work.

NOTE: This connector supports both Cisco-managed and customer-managed Amazon S3 buckets.

NOTE: For customer-managed paths, you can leave the S3 Bucket Prefix empty if you want to use the root of the bucket. If you specify a prefix, do not include a leading slash, and make sure to include the trailing slash.

See documentation and follow the instructions to set up logging and obtain the necessary credentials and information.

For Access Key and Secret Key, you can paste them into the following inputs. For the other required fields, you will retrieve them from Data Path.

For example, the Data Path provided by Cisco is cisco-managed-us-west-1/2003477-12345. For the AWS S3 Bucket Name, the input S3 Bucket Name will be cisco-managed-us-west-1. The S3 Bucket Region will be us-west-1. The S3 Bucket Prefix will be 2003477-1234512345/.

To enable stream-based collection, click Add new collector, choose a Data type, and provide the AWS details.

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

Supported by:Cloudflare

The Cloudflare data connector provides the capability to ingest Cloudflare logs into Microsoft Sentinel using the Cloudflare Logpush and Azure Blob Storage. Refer to Cloudflare documentationfor more information.

NOTE: The Cloudflare (Using Blob Container) (via Codeless Connector Framework) data connector available in the solution requires the Azure Blob Storage account and the Microsoft Sentinel workspace to be in the same Azure subscription and the same Resource Group. Deploying across different subscriptions or resource groups may result in errors such as CreateDataFlowResources not defined during connector configuration.

Supported by:Commvault

The Commvault Security IQ data connector ingests threat indicator anomaly detection events from the Commvault /Client/Anomaly APIenvironments into Microsoft Sentinel. Each recordSentinel, enabling detection and response for threats targeting backup infrastructure such as ransomware and suspicious file operations. Events are stored in the CommvaultAlertsCCF_CL corresponds to one entry in the anomalyClients array and captures fields such as AnomalyType (a bitfield — 64=Ransomware, 8192=VSA Attack), file operation counts (CreateCount, DeleteCount, ModCount, RenameCount, InfectedFilesCount), data sizes (ApplicationSizeMB, BackupSizeMB), and client details (ClientName, ClientId). The connector requires a Commvault Base URL and a valid QSDK Access Token.table.

Log Analytics table(s):

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

• Commvault API Credentials: A Commvault environment Base URL and a valid QSDK Access TokenAPI token are required to authorize API requests.

Setup Instructions:

Commvault Security IQ Connector Instances

This connector polls the Commvault/Client/Anomaly API every 30 minutes and ingests threat anomaly events into the CommvaultAlertsCCF_CL table.

• Data Connectors Grid (configure in portal)

STEP 1 - Configuration steps for the Commvalut QSDK Token

Follow the Commvault instructionsFollow these instructions to create an API token.Token.

STEP 2 - Deploy the connector and the associated Azure Function

3. Enter the Workspace ID, Workspace Key 'and/or Other required fields' and click Next.
4. Click Create to deploy.

ContraForce Events

Supported by:ContraForce

The ContraForce Events connector ingests security service delivery events from your ContraForce workspace into Microsoft Sentinel: incident detections from every connected security platform, administrative access changes (role and member changes), machine credential activity, and destructive workspace actions. Use it to monitor the security operations ContraForce performs on this workspace from inside your own Sentinel.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• ContraForce service account credential: A ContraForce service-account credential with the 'Audit: Export' scope, created in the ContraForce portal under Settings > Developers. The service account must have a role on the workspace you are connecting.

Setup Instructions:

1. Create a ContraForce export credential

In the ContraForce portal, open Settings > Developers, select (or create) a service account that has a role on the workspace you want to connect, and add a credential with the Audit: Export scope. Copy the client ID and the one-time client secret.

Events follow the account they occur under: connect each customer workspace for its events, and your own organization account for organization-level events such as service account and credential activity.

2. Connect your ContraForce workspace

Enter your ContraForce portal URL (change it only if you use a regional portal, e.g. the UK platform), your ContraForce workspace ID (shown in the ContraForce portal URL and workspace settings), and the credential from step 1, then select Connect.

• ContraForce portal URL: (https://portal.contraforce.com)
• ContraForce workspace ID: (00000000-0000-0000-0000-000000000000)
• Client ID: (Client ID)
• Client secret: (Client secret)
• Enable/Disable Connection

Contrast ADR Push Connector

Supported by:Contrast Security

Supported by:Corelight

The Corelight data connector enables incident responders and threat hunters who use Microsoft Sentinel to work faster and more effectively. The data connector enables ingestion of events from Zeek and Suricata via Corelight Sensors into Microsoft Sentinel.Sentinel using the Azure Monitor Logs Ingestion API. Events are sent by the Corelight Sensor to a Data Collection Endpoint (DCE) and routed into dedicated Corelight_v3_*_CL tables by per-log-type Data Collection Rules (DCRs).

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Microsoft Entra ID application: Permission to register an application in Microsoft Entra ID and create a client secret. Typically requires the Application Developer role or higher.
• Azure role assignment: Permission to assign the Monitoring Metrics Publisher role on the deployed Data Collection Rules. Typically requires the Owner or User Access Administrator role on the target resource group.
• Corelight Sensor access: Administrative access to the Corelight Sensor (or Fleet Manager) to configure the Microsoft Sentinel export.

Setup Instructions:

NOTE: This data connector depends on a parser based on a Kusto Function to work as expected Corelight which is deployed with the Microsoft Sentinel Solution.

1. GetDeploy the filesCorelight data collection resources

ContactDeploy the ARM template that creates the Data Collection Endpoint (DCE), the Corelight_v3_*_CL tables, and one Data Collection Rule (DCR) per Corelight log type in your TAM, SE,workspace.

Use the button below to deploy the connector resources into the same subscription and resource group as your Microsoft Sentinel workspace.

aka.ms

When prompted, supply:

The deployment creates:

• One Data Collection Endpoint named dce-corelight-<workspace>
• One custom table per Corelight log type, named Corelight_v3_<log_type>_CL
• One Data Collection Rule per log type, named dcr-corelight-<workspace>-<log_type>, each tagged with corelight-log-type

IMPORTANT: The workspace name must be 18 characters or [email protected]fewer. Each Data Collection Rule is named dcr-corelight-<workspace>-<log_type> and Azure limits resource names to get64 characters. The longest Corelight log type is 32 characters, so a longer workspace name makes some rule names exceed the fileslimit and the deployment fails preflight validation with 'Name' must be between 1 and 64 characters. If your workspace name is longer, deploy Microsoft Sentinel on a workspace with a shorter name.

NOTE: The deployment can take several minutes to complete because a large number of tables and rules are created. Wait for it to finish before continuing.

2. Register a Microsoft Entra ID application

The Corelight Sensor authenticates to the Logs Ingestion API with a Microsoft Entra ID application. Create the application and a client secret, then record the values.

Create the application

1. In the Azure portal, go to Microsoft Entra ID > App registrations > New registration.
2. Enter a name, for example Corelight Sentinel Connector.
3. Under Supported account types, select Accounts in this organizational directory only.
4. Leave Redirect URI empty and select Register.
5. On the application Overview page, copy the Application (client) ID and the Directory (tenant) ID.

Create a client secret

1. On the application page, go to Certificates & secrets > Client secrets > New client secret.
2. Enter a description, choose an expiry, and select Add.
3. Copy the secret Value immediately. It is shown only once and cannot be retrieved later.

You now have the Tenant ID, Client ID, and Client Secret required by the Corelight Sensor.

For more information, see Register an application with Microsoft Entra ID.

3. Grant the application permission to send data

Assign the Monitoring Metrics Publisher role so the application can publish to the Data Collection Rules created in step 1.

Assign the role once at the resource group scope so it covers every Corelight Data Collection Rule in a single assignment.

1. Go to the resource group that contains the deployed DCE and DCRs.
2. Select Access control (IAM) > Add > Add role assignment.
3. On the Role tab, search for and select Monitoring Metrics Publisher.
4. On the Members tab, choose User, group, or service principal, then select the application you registered in step 2.
5. Select Review + assign.

NOTE: Role assignments can take a few minutes to take effect. If the sensor reports authorization errors immediately after assignment, wait and retry.

4. Collect the values needed by the Corelight exporter

The Corelight exporter discovers the Data Collection Rules by tag. Collect the Data Collection Endpoint URI, the subscription ID, and confirm the DCR tag and stream name pattern.

Data Collection Endpoint URI

1. Go to Monitor > Settings > Data Collection Endpoints.
2. Select dce-corelight-<workspace>.
3. On the Overview page, copy the Logs ingestion URI. It has the form https://dce-corelight-<workspace>-<suffix>.<region>.ingest.monitor.azure.com.

Subscription ID

Copy the ID of the subscription that contains the deployed Data Collection Endpoint and Data Collection Rules.

1. In the Azure portal, search for and open Subscriptions.
2. Select the subscription that contains the deployed resources.
3. On the Overview page, copy the Subscription ID.

Data Collection Rule log type tag

The deployment tags every Corelight Data Collection Rule with the log type it accepts. The exporter uses this tag to select the correct DCR for each log, so no immutable ID has to be entered manually.

To review the deployed rules and their log types in the portal, go to Monitor > Settings > Data Collection Rules and look for rules named dcr-corelight-<workspace>-<log_type>.

You can also list them with the Azure CLI. Run the commands from Azure Cloud Shell in the portal, as described in the section below.

az monitor data-collection rule list \
  --resource-group <resource-group> \
  --query "[?tags.solution=='Corelight'].{logType:tags.\"corelight-log-type\", name:name}" \
  --output table

Running the Azure CLI commands from the Azure portal

The Azure CLI commands in this connector can be run directly in the portal using Azure Cloud Shell, with no local installation required.

1. In the Azure portal, select the Cloud Shell icon (>_) in the top toolbar, or go to https://shell.azure.com.

2. When prompted to choose an environment, select Bash. The commands below are written for Bash.

3. If this is your first time using Cloud Shell, follow the prompt to create or select a storage account.

4. Confirm you are in the correct subscription, and switch if needed:

   az account show --output table
   az account set --subscription "<subscription-name-or-id>"
   

5. Add the Data Collection Rule commands, which ship in a CLI extension:

   az extension add --name monitor-control-service
   

6. Paste the command you want to run, replacing <resource-group>, <workspace>, and <log_type> with your own values.

NOTE: The az monitor data-collection rule commands require the monitor-control-service extension. If you run them without it, Cloud Shell offers to install the extension automatically the first time.

Stream names

Each DCR declares a single stream, named after its destination table:

Custom-<table_name>

For most log types the table name follows the pattern Corelight_v3_<log_type>_CL. For example, the conn log type uses the stream Custom-Corelight_v3_conn_CL and lands in the table Corelight_v3_conn_CL. This is why the exporter Stream Name template is set to Custom-Corelight_v3_$LOG_CL in the next step.

IMPORTANT: A small number of log types with long names have a shortened table name, because Log Analytics limits table name length. For those log types the stream name is notCustom-Corelight_v3_<log_type>_CL, and the $LOG template does not resolve to the correct stream. See the list in step 5.

To read the stream name directly from a rule, use the portal under Monitor > Settings > Data Collection Rules > select the rule > JSON View, or run:

az monitor data-collection rule show \
  --resource-group <resource-group> \
  --name dcr-corelight-<workspace>-<log_type> \
  --query "keys(streamDeclarations)" \
  --output tsv

Data Collection Rule immutable IDs (reference only)

The exporter resolves rules through the corelight-log-type tag, so immutable IDs are not required for configuration. If you need one for troubleshooting or for a direct Logs Ingestion API call, read it in the portal under Monitor > Settings > Data Collection Rules > select the rule > JSON View > immutableId, or run:

az monitor data-collection rule show \
  --resource-group <resource-group> \
  --name dcr-corelight-<workspace>-conn \
  --query immutableId \
  --output tsv

5. Configure the Microsoft Sentinel integration.exporter on the Corelight Sensor

Create an Microsoft Sentinel exporter on the Corelight Sensor or in Fleet Manager, using the values collected in the previous steps. The exporter is configured on the Corelight platform and is documented by Corelight.

2. Replay sample data.Configure the exporter on the Corelight platform

Replay sample data to createCorelight documentation

The exporter is created and managed on the needed tables inCorelight platform, using the sensor web interface or Fleet Manager. Follow Corelight's own documentation for the exporter creation steps, the supported sensor and Fleet Manager versions, enabling the dynamic exporter option, and uploading a private CA bundle if your Log Analytics workspace.deployment requires one:

Corelight documentation: Microsoft Sentinel dynamic exporter

Before you begin

• Send sample data (only needed once per Log Analytics workspace): <variable value provided at install time>Steps 1 to 4 of this connector are complete, and you have the Data Collection Endpoint URI, subscription ID, and application credentials.
• The sensor or Fleet Manager can reach the Data Collection Endpoint over outbound HTTPS on port 443. If outbound traffic must traverse a proxy, have the proxy URL ready.
• Your sensor runs a version that supports the Microsoft Sentinel dynamic exporter, and the dynamic exporter option is enabled. Corelight's documentation lists the required versions and the setting to enable.

3. Install custom exporter.Values to enter in the exporter

Install the custom exporter or the logstash container.

4. Configure the Corelight Sensor to send logs to the Azure Log Analytics Agent.

Using the following values, configure your Corelight Sensor to useEnter these values when creating the Microsoft Sentinel exporter. Alternatively,Leave any setting not listed here at its Corelight default unless Corelight advises otherwise.

IMPORTANT: The exporter ships with the default stream name template Custom-Corelight_v2_$LOG_CL. This solution creates v3 tables, so the template must be changed to Custom-Corelight_v3_$LOG_CL. Leaving the default in place sends events to streams that do not exist and the data is rejected.

Use the exporter's log type filter to control which Zeek logs are exported. Enable only the log types you can configureintend to ingest.

NOTE: Ingesting a large number of log types increases Microsoft Sentinel data ingestion cost. Review the logstash container with these values and configure your sensorMicrosoft Sentinel pricing page before enabling the full set.

Log types not covered by the stream name template

26 log types have a shortened table name because of the Log Analytics table name length limit, so Custom-Corelight_v3_$LOG_CL does not resolve to send JSON over TCP to that containertheir stream. To ingest any of these, set the stream name explicitly from the value below rather than relying on the appropriate port.template.

Getting help

• For questions about the exporter itself, sensor or Fleet Manager configuration, supported versions, CA bundles, or exporter errors reported by the sensor, contact your Corelight TAM or SE, or Corelight support at [email protected].
• If the exporter reports success but no data reaches the workspace, the issue is usually on the Azure side. Confirm the role assignment from step 3, the Data Collection Endpoint URI, and the stream name, then continue to step 6.

Workspace ID6. Verify data ingestion: <variable

Confirm that events from the Corelight Sensor are arriving in your workspace.

Allow 5 to 15 minutes after configuring the exporter for the first events to appear, then run the following queries in Logs.

Check which Corelight tables are receiving data:

union withsource=TableName Corelight_v3_*_CL
| summarize EventCount = count(), LastReceived = max(TimeGenerated) by TableName
| sort by LastReceived desc

Check connection events specifically:

Corelight_v3_conn_CL
| take 10

Confirm connectivity:

Corelight_v3_conn_CL
| summarize LastLogReceived = max(TimeGenerated)
| project IsConnected = LastLogReceived > ago(30m)

If no data appears, check the following on the Azure side:

• The Monitoring Metrics Publisher role assignment from step 3 exists at the resource group scope and has taken effect. Role assignments can take several minutes to propagate.
• The Data Collection Endpoint value provided at install time>in the exporter matches the Logs ingestion URI from step 4.
• The exporter Primary Workspace KeyStream Name: <variable value provided at install time> template is Custom-Corelight_v3_$LOG_CL and not the v2 default, and any log type listed in step 5 as having a shortened stream name is configured with its explicit stream name.
• The DCR Log Type Tag is corelight-log-type, and the rules for the log types you enabled exist in the resource group.

If the values above are correct and the sensor still reports export errors, contact Corelight support as described in step 5.

Cortex XDR - Incidents

Data collection rule support:Workspace transform DCR

Prerequisites:

• Crowdstrike OAuth2 API Client and Scopes: #### Required API Scopes In your CrowdStrike Falcon console, go to Support and resources > API clients and keys, select your API client, and enable the following scopes with Read access: Alerts, API Integrations, App Logs, Cases, Correlation Rules, Detections, Hosts, Assets, Incidents, Quarantined Files, Spotlight Vulnerabilities are required for REST API.. For more information, see API.

Setup Instructions:

Connect CrowdStrike to Microsoft Sentinel

Note: Important Notice: The IncidentsRetrieve API is fully decommissioned. UseURL and Client Credentials Log in to your CrowdStrike Console and navigate to the new Cases data type instead.API section to copy your Base API URL. Obtain your Client ID and Client Secret from the API credentials section in your CrowdStrike account.

For detailed instructions on retrieving the Base API URL, Client ID, and Client Secret, please refer to the Connector Tutorial.

Solution version 3.4.0 and later uses the CrowdStrike V2 tables. Please use updated parser for any existing queries. Refer to the release notes of the solution here

Manage CrowdStrike Connections

Add, view, and manage CrowdStrike API connections

• Data Connectors Grid (configure in portal)

2. Choose the ‘Specify template’ option, then ‘Upload a template file’ by clicking on ‘Choose file’ and selecting the appropriate CloudFormation template file provided below. click ‘Choose file’ and select the downloaded template.
3. Click 'Next' and 'Create stack'.

Make sure that your bucket will be created in the same AWS region as your Falcon CID where the FDR feed is provisioned.

• Template 1: OpenID connect authentication deployment: <variable value provided at install time>
• Template 2: AWS CrowdStrike resources deployment: <variable value provided at install time> Using your own S3 Bucket In order to use your own S3 bucket you can refernace the following guide Use your own S3 bucket or follow this steps:

To setup this integration, you will need CBS API Key. You can get these keys using the following links:

CBS API Key found from this URLlink: https://platform.ctm360.com/start/integrations after logging in to your account: https://platform.ctm360.com/start/integrationswith you account

Step 2: Configure Connection

To setup this integration, you will need HackerView API Key. You can get these keys using the following links:

HackerView API Key found from this URLlink: https://platform.ctm360.com/start/integrations after logging in to your account: https://platform.ctm360.com/start/integrationswith you account

Step 2: Configure the Connector

• Install Agent: <variable value provided at install time>

CyberArk Audit

Supported by:CyberArk Support

The CyberArk Audit data connector enables Microsoft Sentinel to ingest security event logs and other events from the CyberArk Audit service via REST API. This integration helps you detect potential security risks, monitor user activity, analyze collaboration patterns, troubleshoot configuration issues, and gain deeper insights into your environment.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• CyberArk Audit Service Platform: Access to perform required configurations in CyberArk Audit platform

Setup Instructions:

Connect to CyberArk Audit API to start collecting event logs in Microsoft Sentinel

Follow the steps below to integrate Microsoft Sentinel with CyberArk Audit and enable centralized monitoring of system and user activities within Microsoft Sentinel. You can also refer to the CyberArk Audit documentation and follow till Step 5.

Step1: Create new SIEM integration

1. On CyberArk portal, go to Administration.
2. Select My environment > Integrations > Export to SIEM.
3. In the SIEM integrations page, select Create > Create SIEM integration
4. In the Create a SIEM integration page, select the Identity Administration link to create an OAuth server web in Identity Administration. Step 2: Create an OAuth2 server web app in Identity Administration
5. On Identity Administration page, from the left menu select Apps & Widgets > Web Apps
6. Select Add Web Apps and create an OAuth2 server type web app from the Custom tab.
7. Enter CyberArkAuditforMicrosoftSentinel in the ApplicationID and Name fields.
8. In the Tokens tab, ensure that the value in the Token Type field is jwtR256 and only the Client Creds authorization method is selected.
9. Click Add in the Scope tab and enter isp.audit.events:read.
10. In the Advanced tab, copy and paste the following script and then click Save.

        setClaim('tenant_id', TenantData.Get("CybrTenantID"));	setClaim('aud', 'cyberark.isp.audit');

1. Click Save. Step 3: Create a service user in Identity Administration
2. Go to the Core Services > Users, select Add User.
3. In the Account section, enter the Login name and Display name as MicrosoftSentinel. Add a new password or generate the password automatically.
4. Select OAuth confidential client.
5. In the Application Settings tab, click Add.
6. Select the CyberArkAuditforMicrosoftSentinel application. This is the name you created in the web service. Step 4: Grant web app permissions to the service user
7. Go to the CyberArkAuditforMicrosoftSentinel web app you created.
8. In the Permissions tab, click Add to find your user MicrosoftSentinel and then click Add.
9. Set the following permissions for the user:
   • Grant
   • View
   • Run
   • Automatically deploy Step 5: Define the integration description
10. Go to Administration.
11. Select My environment > Integrations > Export to SIEM.
12. Select Create > Create SIEM integration.
13. Enter the name as Microsoft Sentinel Integration and optionally add a description.
14. Click Apply. Step 6: Connect CyberArk Audit Service with Microsoft Sentinel Data Connector

Note: Copy all the details you captured in the previous steps and connect with the CyberArk Audit service.

• OAuth2 Server App Name: (e.g. AuditforMicrosoftSentinel)
• Audit API Key: (The API Key can be retrieved from the Audit service)
• Identity Endpoint: (e.g. kln9281.id.cyberark.cloud)
• Audit API Base URL: (e.g. org-test.audit.cyberark.cloud)
• Audit Query Filter Action (Optional): (e.g. {"op":"include","params":["cloud.core.login","cloud.core.mfasummary"]})
• Audit Query Filter Application Code (Optional): (e.g. {"op":"include","params":["IDP","CMS"]})
• Audit Query Filter Audit Type (Optional): (e.g. {"op":"include","params":["Failure"]})

CyberArk EPM

Supported by:CyberArk Support

Prerequisites:

• CyberArk EPM Platform: Access to perform required configurations in CyberArk EPM platform

Setup Instructions:

Connect to CyberArk EPM API to start collecting event logs in Microsoft Sentinel

Follow the configuration steps here to integrate Microsoft Sentinel with CyberArk EPM and enable centralized monitoring of endpoint events within Microsoft Sentinel.

• Web App ID: (The OAuth2 server web app ApplicationID)
• Region based Tenant URL: (e.g. api-na.epm.cyberark.cloud)
• Set ID: (List of comma seperated EPM Set IDs to poll events from)
• Identity Endpoint: (e.g. kln9281.id.cyberark.cloud)

CyberArkAuditCyberArkEPM (using Azure Functions)

Data collection rule support:Workspace transform DCR

Prerequisites:

Cyborg Security offers Community Memebers access to a subset of the Emerging Threat Collections and hunt packages.

Create a Free Commuinity Account to get access to Cyborg Security's Hunt Packages: Sign Up Now!

2. Configure the Open in Tool Feature

• Product with Version-Associated Vulnerabilities:
• Enable/Disable Connection

Cyjax Threat Intelligence IOC Connector (using Azure Functions)

Supported by:CyberArk SupportCyjax

The CyberArk AuditCyjax Threat Intelligence IOC data connector provides the capability to retrieve security event logsingest Indicators of Compromise (IOCs) from the CyberArk Audit service and more eventsCyjax API v2 into Microsoft Sentinel through the REST API.as STIX 2.1 Threat Intelligence indicators. The connector enables event retrievalfetches IOCs including IPs, domains, URLs, file hashes, emails, and hostnames, enriches them with GeoIP, ASN, and sighting data, and uploads them to assess potential security risks, monitor collaboration,the Microsoft Sentinel Threat Intelligence platform via the Upload Indicator API.

The connector supports:

• Automated IOC collection with configurable schedule
• IOC enrichment with GeoIP, ASN, and diagnose and troubleshoot configuration issues.
  sighting data
• STIX 2.1 indicator mapping with TLP markings
• Incremental fetching with checkpoint management

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Azure Subscription: Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group.
• Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. For more information, see Azure Functions.
• Audit RESTCyjax API Connections details and Credentials: OauthUsername, OauthPassword, WebAppID, AuditApiKey, IdentityEndpoint and AuditApiBaseUrl are required for makingA Cyjax API calls.v2 access token (Bearer Token) is required. Contact Cyjax to obtain API credentials.

Setup Instructions:

Resource Group

You need to have a resource group created with a subscription you are going to use.

Functions App

You need to have an Azure App registered for this connector to use:

1. Application (Client) ID
2. Tenant ID
3. Client Secret

NOTE: This connector uses Azure Functions to connect to the Azure Blob StorageCyjax API v2 to pull logsIOC indicators into Microsoft Sentinel. This might result in additional costs for data ingestion and for storing data in Azure Blob Storage costs. Check the Azure Functions pricing page and Azure Blob Storage pricing page for details.

NOTE: API authorization key(s) or token(s) are securely stored in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values.

STEP 1 - ConfigurationApp Registration steps for the CyberArk Audit SIEM IntegrationApplication in Microsoft Entra ID

This integration requires an App registration in the Azure portal. Follow the instructionssteps in this section to obtain connection detailscreate a new application in Microsoft Entra ID:

1. Sign in to the Azure portal.
2. Search for and credentials.select Microsoft Entra ID.
3. Under Manage, select App registrations > New registration.
4. Enter a display Name for your application.
5. Select Register to complete the initial app registration.
6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the Application (client) ID and Tenant ID. The client ID and Tenant ID are required as configuration parameters for the execution of the Cyjax IOC Data Connector.

Reference link:/azure/active-directory/develop/quickstart-register-app

STEP 2 - Choose ONEAdd a client secret for application in Microsoft Entra ID

Sometimes called an application password, a client secret is a string value required for the execution of the Cyjax IOC Data Connector. Follow the steps in this section to create a new Client Secret:

1. In the Azure portal, in App registrations, select your application.
2. Select Certificates & secrets > Client secrets > New client secret.
3. Add a description for your client secret.
4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.
5. Select Add.
6. Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page. The secret value is required as configuration parameter for the execution of the Cyjax IOC Data Connector.

Reference link:/azure/active-directory/develop/quickstart-register-app#add-a-client-secret

STEP 3 - Assign Microsoft Sentinel Contributor Role

Assign the Microsoft Sentinel Contributor role to the App Registration to allow it to upload threat intelligence indicators:

1. Go to the Log Analytics workspace associated with your Microsoft Sentinel instance.
2. Select Access control (IAM) from the following two deployment optionsleft menu.
3. Click Add > Add role assignment.
4. Search for Microsoft Sentinel Contributor and select it.
5. Under Members, select User, group, or service principal and search for your App Registration name.
6. Select the app and click Review + assign.

STEP 4 - Obtain Cyjax API Credentials

Contact Cyjax to deployobtain your API v2 access token (Bearer Token). This token is used to authenticate requests to the connectorCyjax IOC and enrichment endpoints.

STEP 5 - Deploy the associated Azure FunctionCyjax IOC Connector

IMPORTANT: Before deploying the CyberArk Audit dataCyjax IOC connector, have the Workspace NameCyjax API access token, Azure App Registration credentials (Client ID, Client Secret, Tenant ID), and Workspace Location (can be copied from the following).ID readily available.

• Workspace Name: <variable value provided at install time>
• Workspace LocationID: <variable value provided at install time>

Option 1 - Azure Resource Manager (ARM) Template

Use this method for automated deployment of the CyberArk Audit data connector using an ARM Template.Cyjax IOC Data Connector.

1. Click the Deploy to Azure button below.

   aka.msaka.msaka.ms

2. Select the preferred Subscription, Resource Group and LocationRegion.

NOTE: Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group. 3. Enter the below information:

a. CyberArkAuditUsername, CyberArkAuditPassword, CyberArkAuditServerURLFunctionName - Enter a unique Function App name (max 11 characters)

b. Location - The location for data collection rules and deploy. 4. endpoints deployment

c. WorkspaceID - Enter the Log Analytics Workspace ID

d. AzureClientID - Enter Azure Client ID from your App Registration

e. AzureClientSecret - Enter Azure Client Secret from your App Registration

f. AzureTenantID - Enter Azure Tenant ID

g. CyjaxBaseURL - Enter Cyjax API v2 Base URL (default: https://api.cymon.co/v2)

h. CyjaxAccessToken - Enter Cyjax API Bearer Token

i. LookbackDays - Number of days to look back on first run (default: 1)

j. EnableEnrichment - Set to true to enrich IOCs with GeoIP, ASN, and sighting data. Set to false to skip enrichment and reduce API calls and execution time (default: true)

k. IOCQuery - Optional free-text search query to filter IOCs from the Cyjax API (e.g. a keyword, threat actor, or campaign name). Leave empty to fetch all available IOCs

l. IndicatorType - Filter IOCs by type. Enter comma-separated values (e.g., URL,Domain,IPv4). Supported types: URL, Domain, IPv4, IPv6, Hostname, Email, FileHash-SHA1, FileHash-SHA256, FileHash-MD5, FileHash-SSDEEP. Leave empty to fetch all types

m. Schedule - Enter a valid Quartz Cron-Expression (default: every 10 minutes)

n. LogLevel - Set the log level (default: Info)

o. AppInsightsWorkspaceResourceID - Enter the Application Insights Workspace Resource ID

Mark the checkbox labeled I agree to the terms and conditions stated above. 5.

Click Purchase to deploy.

Option 2 - Manual Deployment of Azure Functions

Use the following step-by-step instructions to deploy the CyberArk AuditCyjax IOC data connector manually with Azure Functions (Deployment via Visual Studio Code).

1. Deploy a Function App

NOTE: You will need to prepare VS code for Azure function development.

1. Download the Azure Function AppAzure Function App file. Extract archive to your local development computer.

2. Start VS Code. Choose File in the main menu and select Open Folder.

3. Select the top level folder from extracted files.

4. Choose the Azure icon in the Activity bar, then in the Azure: Functions area, choose the Deploy to function app button. If you aren't already signed in, choose the Azure icon in the Activity bar, then in the Azure: Functions area, choose Sign in to Azure If you're already signed in, go to the next step.

5. Provide the following information at the prompts:

   a. Select folder: Choose a folder from your workspace or browse to one that contains your function app.

   b. Select Subscription: Choose the subscription to use.

   c. Select Create new Function App in Azure (Don't choose the Advanced option)

   d. Enter a globally unique name for the function app: Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CyberArkXXXXX)CYJAXXXXXX).

   e. Select a runtime: Choose Python 3.10.12

   f. Select a location for new resources. For better performance and lower costs choose the same region where Microsoft Sentinel is located.

6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.

7. Go to Azure Portal for the Function App configuration.

8. Configure the Function App

9. In the Function App, select the Function App Name and select Configuration.

10. In the Application settings tab, select + New application setting.

11. Add each of the following application settings individually, with their respective string values (case-sensitive): CyberArkAuditUsername CyberArkAuditPassword CyberArkAuditServerURL WorkspaceID WorkspaceKey logAnalyticsUri (optional)

• WorkspaceID - Your Log Analytics Workspace ID
• AzureClientID - Azure Client ID from your App Registration
• AzureClientSecret - Azure Client Secret from your App Registration
• AzureTenantID - Your Azure Tenant ID
• CyjaxBaseURL - Cyjax API v2 Base URL (default: https://api.cymon.co/v2)
• CyjaxAccessToken - Your Cyjax API Bearer Token
• LookbackDays - Number of days to look back on first run (default: 1)
• EnableEnrichment - Set to true to enrich IOCs with GeoIP, ASN, and sighting data. Set to false to skip enrichment and reduce API calls and execution time (default: true)
• IOCQuery - Optional free-text search query to filter IOCs from the Cyjax API (e.g. a keyword, threat actor, or campaign name). Leave empty to fetch all available IOCs (optional)
• IndicatorType - Filter IOCs by type. Enter comma-separated values (e.g., URL,Domain,IPv4). Supported types: URL, Domain, IPv4, IPv6, Hostname, Email, FileHash-SHA1, FileHash-SHA256, FileHash-MD5, FileHash-SSDEEP. Leave empty to fetch all types (optional)
• Schedule - Quartz Cron-Expression (default: every 10 minutes)
• LogLevel - Log level (default: Info)
• AppInsightsWorkspaceResourceID - Application Insights Workspace Resource ID (optional)
• logAnalyticsUri (optional) - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: https://<CustomerId>.ods.opinsights.azure.us.

1. Once all application settings have been entered, click Save.

CyberArkEPM (using Azure Functions)

Data collection rule support: Not currently supported

Prerequisites:

Cyborg Security offers Community Memebers access to a subset of the Emerging Threat Collections and hunt packages.

Create a free community account to get access to Cyborg Security's Hunt Packages.

2. Configure the Open in Tool Feature

• Product with Version-Associated Vulnerabilities:
• Enable/Disable Connection

Cynerio Security Events

Supported by:Cynerio - Check that alerts from Doppel are successfully forwarded to Microsoft Sentinel. - Validate that the Workbook in Microsoft Sentinel is updated with the alert statistics, ensuring seamless data integration.

Dragon Copilot

Supported by:Microsoft

Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Microsoft Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Tenant Permissions: 'Security Administrator' or 'Global Administrator' on the workspace's tenant.

Setup Instructions:

Connect Dragon Copilot audit logs to Microsoft Sentinel

This connector uses the Office Management API to get your Dragon Copilot audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the DragonCopilot table.

• Enable/Disable Connection

Dragos Notifications via Cloud Sitestore

Supported by:Dragos Inc

Data collection rule support:Workspace transform DCR

Dynatrace Attacks V1

Supported by:Dynatrace

Data collection rule support: Not currently supported

Configure and Enable Dynatrace Application Security. Follow these instructions to generate an access token.

Dynatrace Attacks V2

Supported by:Dynatrace

This connector uses the Dynatrace Attacks REST API to ingest detected attacks into Microsoft Sentinel Log Analytics

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Dynatrace tenant (ex. xyz.dynatrace.com): You need a valid Dynatrace tenant with Application Security enabled, learn more about the Dynatrace platform.
• Dynatrace Access Token: You need a Dynatrace Access Token, the token should have Read attacks (attacks.read) scope.

Setup Instructions:

Dynatrace Attack Events to Microsoft Sentinel

Configure and Enable Dynatrace Application Security. Follow these instructions to generate an access token.

• Dynatrace tenant (ex. xyz.dynatrace.com): ({{dynatraceEnvironmentUrl}})
• Dynatrace Access Token: ({{dynatraceAccessToken}})
• Enable/Disable Connection

Dynatrace Audit Logs V1Attacks V3

Supported by:Dynatrace

This connector uses the Dynatrace DQL Storage Query API to ingest detected application security attacks into Microsoft Sentinel Log Analytics.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR Not currently supported

Prerequisites:

• Dynatrace SaaS environment (ex. xyz.apps.dynatrace.com): You need a Dynatrace SaaS environment (xxx.apps.dynatrace.com) with Application Security enabled. Classic Dynatrace environments (xxx.live.dynatrace.com) are not supported.
• Dynatrace Platform Token: You need a Dynatrace platform token with the storage:buckets:read and storage:security.events:read scopes. See Dynatrace platform tokens for instructions.

Setup Instructions:

Dynatrace Attack Events to Microsoft Sentinel

Configure and Enable Dynatrace Audit LoggingApplication Security. Follow these instructions to generate an access token.

1. Create a platform token with the storage:buckets:read* and *storage:security.events:read scopes following these instructions.
2. Use your Dynatrace SaaS environment URL in the format xyz.apps.dynatrace.com.

• Dynatrace environment (ex. xyz.apps.dynatrace.com): ({{dynatraceEnvironmentUrl}})
• Dynatrace Platform Token: ({{dynatracePlatformToken}})
• Enable/Disable Connection

Dynatrace Audit Logs V2

Supported by:Dynatrace

This connector uses the Dynatrace Audit Logs REST API to ingest tenant audit logs into Microsoft Sentinel Log Analytics

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Dynatrace tenant (ex. xyz.dynatrace.com): You need a valid Dynatrace Tenant, to learn more about the Dynatrace platform Start your free trial.
• Dynatrace Access Token: You need a Dynatrace Access Token, the token should have Read audit logs (auditLogs.read) scope.

Setup Instructions:

Dynatrace Audit Log Events to Microsoft Sentinel

Enable Dynatrace Audit Logging. Follow these instructions to generate an access token.

• Dynatrace tenant (ex. xyz.dynatrace.com): ({{dynatraceEnvironmentUrl}})
• Dynatrace Access Token: ({{dynatraceAccessToken}})
• Enable/Disable Connection

Dynatrace Problems V1Audit Logs V3

Supported by:Dynatrace

This connector uses the Dynatrace DQL Storage Query API to ingest tenant audit log events into Microsoft Sentinel Log Analytics.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Dynatrace SaaS environment (ex. xyz.apps.dynatrace.com): You need a Dynatrace SaaS environment (xxx.apps.dynatrace.com). Classic Dynatrace environments (xxx.live.dynatrace.com) are not supported.
• Dynatrace Platform Token: You need a Dynatrace platform token with the storage:buckets:read and storage:system:read scopes. See Dynatrace platform tokens for instructions.

Follow these instructionsSetup Instructions:

Dynatrace Audit Log Events to generate an access token.Microsoft Sentinel

Enable Dynatrace Audit Logging.

1. Create a platform token with the storage:buckets:read* and *storage:system:read scopes following these instructions.
2. Use your Dynatrace SaaS environment URL in the format xyz.apps.dynatrace.com. Classic Dynatrace environments (xxx.live.dynatrace.com) are not supported.

• Dynatrace environment (ex. xyz.apps.dynatrace.com): ({{dynatraceEnvironmentUrl}})
• Dynatrace Platform Token: ({{dynatracePlatformToken}})
• Enable/Disable Connection

Dynatrace Problems V2

Supported by:Dynatrace

This connector uses the Dynatrace Problem REST API to ingest problem events into Microsoft Sentinel Log Analytics

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Dynatrace tenant (ex. xyz.dynatrace.com): You need a valid Dynatrace Tenant, to learn more about the Dynatrace platform Start your free trial.
• Dynatrace Access Token: You need a Dynatrace Access Token, the token should have Read problems (problems.read) scope.

Setup Instructions:

Dynatrace Problem Events to Microsoft Sentinel

Follow these instructions to generate an access token.

• Dynatrace tenant (ex. xyz.dynatrace.com): ({{dynatraceEnvironmentUrl}})
• Dynatrace Access Token: ({{dynatraceAccessToken}})
• Enable/Disable Connection

Dynatrace Runtime Vulnerabilities V1Problems V3

Supported by:Dynatrace

This connector uses the Dynatrace DQL Storage Query API to ingest Davis AI problem events into Microsoft Sentinel Log Analytics.

Log Analytics table(s):

Data collection rule support: Not currently supported

ConfigurePrerequisites:

• Dynatrace SaaS environment (ex. xyz.apps.dynatrace.com): You need a Dynatrace SaaS environment (xxx.apps.dynatrace.com). Classic Dynatrace environments (xxx.live.dynatrace.com) are not supported.
• Dynatrace Platform Token: You need a Dynatrace platform token with the storage:buckets:read and Enable storage:events:read scopes. See Dynatrace platform tokens for instructions.

Setup Instructions:

Dynatrace Application SecurityProblem Events to Microsoft Sentinel

1. Create a platform token with the storage:buckets:read* and *storage:events:read scopes following these instructions.
2. Use your Dynatrace SaaS environment URL in the format xyz.apps.dynatrace.com. Follow these instructions to generate an access token.
   Classic Dynatrace environments (xxx.live.dynatrace.com) are not supported.

• Dynatrace environment (ex. xyz.apps.dynatrace.com): ({{dynatraceEnvironmentUrl}})
• Dynatrace Platform Token: ({{dynatracePlatformToken}})
• Enable/Disable Connection

Dynatrace Runtime Vulnerabilities V2

Supported by:Dynatrace

This connector uses the Dynatrace Security Problem REST API to ingest detected runtime vulnerabilities into Microsoft Sentinel Log Analytics.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Dynatrace tenant (ex. xyz.dynatrace.com): You need a valid Dynatrace tenant with Application Security enabled, learn more about the Dynatrace platform.
• Dynatrace Access Token: You need a Dynatrace Access Token, the token should have Read security problems (securityProblems.read) scope.

Setup Instructions:

Dynatrace Vulnerabilities Events to Microsoft Sentinel

Configure and Enable Dynatrace Application Security. Follow these instructions to generate an access token.

• Dynatrace tenant (ex. xyz.dynatrace.com): ({{dynatraceEnvironmentUrl}})
• Dynatrace Access Token: ({{dynatraceAccessToken}})
• Enable/Disable Connection

Dynatrace Runtime Vulnerabilities V3

Supported by:Dynatrace

This connector uses the Dynatrace DQL Storage Query API to ingest detected runtime vulnerabilities into Microsoft Sentinel Log Analytics.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Dynatrace SaaS environment (ex. xyz.apps.dynatrace.com): You need a Dynatrace SaaS environment (xxx.apps.dynatrace.com) with Application Security enabled. Classic Dynatrace environments (xxx.live.dynatrace.com) are not supported.
• Dynatrace Platform Token: You need a Dynatrace platform token with the storage:buckets:read and storage:security.events:read scopes. See Dynatrace platform tokens for instructions.

Setup Instructions:

Dynatrace Vulnerabilities Events to Microsoft Sentinel

Configure and Enable Dynatrace Application Security.

1. Create a platform token with the storage:buckets:read* and *storage:security.events:read scopes following these instructions.
2. Use your Dynatrace SaaS environment URL in the format xyz.apps.dynatrace.com.
3. In Microsoft Sentinel → Content Hub, find the Dynatrace solution and enable the Consolidate Dynatrace Runtime Vulnerabilities summary rule. This is required to consolidate raw vulnerability events into the table used by analytics rules and the parser.

• Dynatrace environment (ex. xyz.apps.dynatrace.com): ({{dynatraceEnvironmentUrl}})
• Dynatrace Platform Token: ({{dynatracePlatformToken}})
• Enable/Disable Connection

Egress Defend

Supported by:egress1589289169584

The Egress Defend audit connector provides the capability to ingest Egress Defend Data into Microsoft Sentinel.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Egress API Token: An Egress API token is required to ingest audit records to Microsoft Sentinel.

Setup Instructions:

Connect Egress Defend with Microsoft Sentinel

Enter your Egress Defend API URl, Egress Domain and API token.

Egress Defend v2

Supported by:egress1589289169584

The Egress Defend audit connector ingests Egress Defend audit data into Microsoft Sentinel via the Logs Ingestion API (DCR-based). It pulls from the Egress Defend V1/events API and lands events in the EgressDefend_v4_CL table.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Egress Defend API access: An Egress Defend API URL, customer domain and API key are required to ingest audit records into Microsoft Sentinel.

Setup Instructions:

Connect Egress Defend to Microsoft Sentinel

Enter your Egress Defend API URL, Egress domain and API key, then click Connect.

• API URL:
• Domain name:
• API Key:
• Enable/Disable Connection

Elastic Agent

Connect using OAuth2 credentials

• API URL (optional): (https://api.shield.ermessecurity.comhttps://api.shield.ermessecurity.com)

ESET Protect Platform (using Azure Functions)

NOTE: The ESET Protect Platform data connector uses Azure Functions to connect to the ESET Protect Platform via Eset Connect API to pull detections logs into Microsoft Sentinel. This process might result in additional data ingestion costs. See details on the Azure Functions pricing page.

NOTE: The newest version of the ESET PROTECT Platform and Microsoft Sentinel integration pulls not only detections logs but also newly created incidents. If your integration was set up before 20.06.2025, please follow the vendor instructionsthese steps to update it.

Step 1 - Create an API user

Follow the vendor instructionsUse this instruction to create an ESET Connect API User account with Login and Password.

Step 2 - Create a registered application

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

Feedly IoC

Supported by:Feedly IncFeedly Inc

The Feedly IoC data connector provides the capability to ingestingests Indicators of Compromise (IoCs) from the Feedly API into the native ThreatIntelIndicators table in Microsoft Sentinel. Indicators are tagged with SourceSystem == "Feedly" so they participate in Microsoft Sentinel threat-intelligence matching, analytics, and hunting the same way as other TIP integrations (for example Recorded Future via the Upload Indicators API).

Log Analytics table(s):

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

Connect to Feedly to start collecting IoCs in Microsoft Sentinel

1. Go to https://feedly.com/i/team/api and generate a new API token for the connector.
2. In Microsoft Sentinel, in the connector page - provide your Feedly API Key and Stream IDs. ThenIDs, then click Connect.
3. Indicators are written to the native ThreatIntelIndicators table with SourceSystem Feedly. Query them with: ThreatIntelIndicators | where SourceSystem == "ConnectFeedly".

• Feedly API Key: (Enter your Feedly API token)
• Feedly Stream IDs: (streamId1,streamId2,streamId3)

Supported by:Microsoft Corporation

The Forescout data connector provides the capability to ingest Forescout eventsForescout events into Microsoft Sentinel. Refer to Forescout documentationForescout documentation for more information.

Log Analytics table(s):

Follow the configuration steps below to get Forescout logs into Microsoft Sentinel.

1. Select an appliance to configure.Select an Appliance to Configure.
2. Follow the vendor instructionsFollow these instructions to forward alerts from the Forescout platform to a syslog server.
3. ConfigureConfigure the settings in the Syslog Triggers tab.

Forescout Host Property Monitor

Supported by:Microsoft Corporation

The Forescout Host Property Monitor connector allows you to connect host properties from Forescout platform with Microsoft Sentinel, to view, create custom incidents, and improve investigation. This gives you more insight into your organization network and improves your security operation capabilities.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Forescout Plugin requirement: Please make sure Forescout Microsoft Sentinel plugin is running on Forescout platform

Setup Instructions:

Instructions on how to configure the Forescout Microsoft Sentinel plugin are provided at the Forescout Documentation Portal (https://docs.forescout.com/bundle/sentinel-1-0-h).

• Workspace ID: <variable value provided at install time>
• Primary Key: <variable value provided at install time>

Fortinet FortiNDR Cloud

Supported by:Microsoft Corporation

The Fortra Agari Data Connector allows ingesting logs from Fortra Agari Brand Protection (BP) and Phishing Defense (APD) APIs into Microsoft Sentinel. This connector integrates with Agari Brand Protection (BP), Phishing Defense (APD), and Phishing Response (APR) products. It supports DCR-based ingestion time transformations for efficient query execution. Refer to Agari API documentation for more information.

Log Analytics table(s):

Data collection rule support: Not currently supported

Setup Instructions:

Configuration steps for the Agari API connections

Follow the instructions below to obtain yourAdd and manage independent Agari API credentials.tenant connections.

1. Retrieve API URL Log in to your Agari Console and navigate to the API section. The default API URL is https://api.agari.com
2. Retrieve Client Credentials Obtain your Client ID and Client Secret from the API credentials section in your Agari account. Note that different Agari products (Brand Protection, Phishing Defense, Phishing Response) may require separate API credentials.
3. Select Data Streams Choose which Agari data streams you want to collect. You can select one or more streams based on your subscription and requirements.

• Base API URL: (https://api.agari.com)
• Client ID: (Your Client ID)
• Client Secret: (Your Client Secret)
• Enable/Disable ConnectionData Connectors Grid (configure in portal)

Gambit Security Policy Issues (Push)

Data collection rule support:Workspace transform DCR

• Subscription permissions: You need the following permissions to deploy the connector's data flow resources:
• Contributor role on the subscription or resource group - to deploy Event Grid, storage queues, DCR, and related connector resources.
• Owner or User Access Administrator role on the Storage Account - to assign RBAC roles to the Microsoft Sentinel service principal.principal and, when Create is selected, the Event Grid system topic's managed identity.
• Owner or Event Grid Contributor role on the Storage Account - to create or update Event Grid system topicstopics, enable system-assigned identity, and create or update event subscriptions.

Note: The Microsoft.EventGrid resource provider must be registered in the subscription containing the storage account.

Important: Do not configure network rules based on GitHub IP ranges. GitHub does not provide stable IP ranges as the source of audit log streaming, and those IPs may change without notice.

• Event Grid delivery identity: The connector enables a system-assigned managed identity on a new or supplied existing Event Grid system topic. When a topic name is supplied, the connector reads the topic before updating it, preserving its tags, attached user-assigned identities, and any already enabled system-assigned principal. The connector always creates or updates its generated event subscription using the topic's system-assigned identity; the subscription's delivery configuration and filters remain connector-managed.

Choose Create to grant that identity Storage Queue Data Message Sender on the destination storage account, or Use existing to skip creating the sender grant when the identity already has that permission, as required by Event Grid Storage Queue delivery. Use Create for a new topic or a newly enabled system-assigned identity. Account-scoped sender access allows adding messages to queues in that account, not reading or deleting messages or accessing blobs. This identity is separate from the existing ScubaSentinelToStorageProd collector application, which remains unchanged and continues to read blobs and consume queue messages. An existing topic must belong to the selected storage account.

Using Network Security Perimeter (NSP) is optional. If your storage account is in an Enforced NSP, allow inbound traffic from the Event Grid topic's subscription and the Scuba service IPv4 ranges, as described in Enable network security. The connector does not enable NSP or change its rules, associations, or access mode.

The system-assigned identity has no additional charge and requires no deployment script, container instance, or temporary storage account. Normal Event Grid, Storage, and Microsoft Sentinel charges still apply.

• Storage Account Role Assignments: The following Azure RBAC roles must be assigned to the Microsoft Sentinel enterprise application service principal (displayed below) on the Storage Account that contains your blob container:
• Storage Blob Data Reader - required for reading blob data from the container.
• Storage Queue Data Contributor - required for managing notification and dead-letter queue messages.

Connect GitHub Audit Logs to Microsoft Sentinel

To enableUse the connection grid to add and manage GitHub Audit Log ingestion from Azure Blob Storage, provide the required information below and click on Connect.blob connections.

• The blob container URL you want to collect data from:
• The blob folder nameData Connectors Grid (configure in the container. Optional.:
• The blob container's storage account location: (eastus)
• The blob container's storage account resource group name: (my-resource-group)
• The blob container's storage account subscription id:
• The Event Grid system topic name for the storage account, if one exists; otherwise, leave empty.:
• Enable/Disable Connectionportal)

Blob Lifecycle Policy (Recommended)

If you encounter issues with data ingestion:

• Managed Identity Authorization Error - Confirm the Event Grid system topic's current system-assigned principal has Storage Queue Data Message Sender at the destination storage-account scope, not only on the notification queue. Use existing skips creating that grant; it does not discover or repair permissions. This is not the Microsoft Sentinel service principal displayed in the connection form. RBAC propagation: If Connect fails with Managed Identity Authorization Error, wait about five minutes and retry with the same values. Propagation can take up to ten minutes.
• Keep the same topic and identity when retrying. Recreating the topic or toggling its identity creates a different principal and requires a new grant. If the error persists with the correct account-scoped grant, retain the failed operation's request ID and UTC timestamp for support.
• Event Grid subscription creation fails with an internal error or disappears after appearing - Check the failed deployment operation and any Enforced NSP on the storage account. Event Grid must use system-assigned managed-identity delivery with Storage Queue Data Message Sender access on the storage account and an NSP inbound subscription rule. A subscription can appear while provisioning and be rolled back if provisioning fails; this does not necessarily mean a duplicate resource exists. Review NSP diagnostic logs and retain the Event Grid request ID and UTC timestamp for support if the failure persists.
• Enable the health feature - If the connector health feature isn't enabled, enable it to monitor connector status and detect issues early.
• Enable diagnostic logs - Consider enabling diagnostic logs for both the Storage Account and Event Grid resources to help identify and troubleshoot health issues.
• For more details, see Troubleshoot Azure Storage Blob connector issues.

Supported by:Google

The Google Threat Intelligence (virustotal) data connector ingests GTI Relevance System Alerts into Microsoft Sentinel. The connector polls the GTI Relevance System Alerts API on a configurable schedule and stores Relevance System Alerts data in the RelevanceSystemAlerts_CL custom table, enabling security analysts to investigate threats, correlate incidents, and respond to intelligence-driven alerts within the Microsoft Sentinel workspace.

Log Analytics table(s):

Data collection rule support: Not currently supportedWorkspace transform DCR

Prerequisites:

• The connector automatically retries with exponential backoff. If errors persist, reduce the polling frequency by increasing the Schedule cron interval.

Google Threat Intelligence Vulnerabilities (CCF)

Supported by:Google

The Google Threat Intelligence (GTI) Vulnerabilities data connector ingests Vulnerability collection objects from the Google Threat Intelligence (VirusTotal) Collections API into Microsoft Sentinel using the Codeless Connector Framework (CCF) — no Azure Function or agent to deploy.The connector authenticates with your GTI API key (sent in the x-apikey header), always scopes the query to collection_type:vulnerability, sorts by last modification date ascending (firstly-modified objects first), and polls on a rolling time window so each cycle only retrieves vulnerabilities modified since the previous poll. An optional free-form filter can be supplied to refine the search (for example risk_rating:Critical, cvss_3x_base_score:4+).Ingested data lands in the GTI_Vulnerabilities_CL table and supports DCR-based ingestion-time transformations so enriched fields (risk rating, CVSS scores, exploitation state) are available for fast querying.

Log Analytics table(s):

Data collection rule support:Workspace transform DCR

Prerequisites:

• Google Threat Intelligence / VirusTotal account: An active Google Threat Intelligence (VirusTotal) account is required. The vulnerabilities feed is part of the GTI Collections API and requires a subscription/privileges that include vulnerability collections.
• Google Threat Intelligence API Key: A valid GTI / VirusTotal API key with access to the Collections API. The key is sent in the 'x-apikey' request header. Treat it as a secret — it is stored as a securestring and never displayed after entry.

Setup Instructions:

Prerequisites

Before you connect, make sure the following are in place.

Before you begin

1. Permissions on this workspace — you need read and write permissions on the Microsoft Sentinel workspace to create the data connection.
2. A Google Threat Intelligence (VirusTotal) account with access to the Collections API and to vulnerability collections. If you do not see vulnerability data, confirm your subscription/privileges with your GTI administrator.
3. A GTI API key — see the next step to generate it. The key is sent in the x-apikey header on every request.

1. Generate your Google Threat Intelligence API key

Obtain the API key the connector uses to authenticate.

Get your API key

1. Sign in to your account at https://www.virustotal.com (or your Google Threat Intelligence portal).
2. Click your avatar in the top-right corner and select API key, or go directly to the API key page.
3. Copy the API key shown on that page. This single value is all the connector needs.

The same key is documented in the GTI reference under List vulnerabilities.

Note: Keep your API key secret. Anyone with the key can query the GTI API as you and consume your quota. If a key is exposed, regenerate it from the API key page and update the connector. The connector stores the key as a securestring — it is not displayed again after you connect.

Note: API quota & rate limits: GTI/VirusTotal enforces per-minute and daily request quotas tied to your subscription tier. The connector requests up to 40 objects per page and throttles itself (~4 requests/second). If you hit HTTP 429 (rate limit) errors, choose a longer Polling interval below and/or narrow the result set with the Vulnerability filter.

2. Connect Google Threat Intelligence Vulnerabilities to Microsoft Sentinel

Provide the values below and select Connect. The connector always scopes the query to collection_type:vulnerability and sorts by last-modification-date ascending (firstly-modified objects first).

Connection settings

• GTI API Key: (Paste your Google Threat Intelligence API key (sent in the x-apikey header))

Note: Required. The API key copied from the GTI / VirusTotal API key page. It is sent in the 'x-apikey' header on every request.

• Vulnerability filter (optional): (e.g. risk_rating:Critical cvss_3x_base_score:4+)

Note: Optional. A GTI search expression appended to the mandatory 'collection_type:vulnerability' filter to narrow ingestion. Examples: 'risk_rating:Critical', 'cvss_3x_base_score:4+', 'exploitation_state:Confirmed'. Leave blank to ingest all vulnerability objects. Separate multiple conditions with spaces.

Note: Required. How often Sentinel queries the GTI API. Each poll uses a rolling time window equal to this interval, so no vulnerabilities are skipped or double-counted. Choose a longer interval if you are rate-limited or only need periodic updates.

• Enable/Disable Connection

3. Verify data is flowing

After connecting, confirm vulnerabilities are being ingested.

Validate the connection

Data can take up to ~30 minutes to appear after the first successful poll. Once it does:

1. On this page, the GTI_Vulnerabilities_CL data type shows a recent Last data received timestamp and the status turns green.

2. Run this query in Logs to confirm rows are arriving:

   GTI_Vulnerabilities_CL | summarize Count = count(), Latest = max(TimeGenerated)

3. Inspect a sample of the enriched fields:

   GTI_Vulnerabilities_CL | project TimeGenerated, Name, RiskRating, ExploitationState, Cvss3xBaseScore | sort by TimeGenerated desc | take 20

Optional — connector health: enable Microsoft Sentinel → Settings → Health and Audit to log per-poll status. Then run:

SentinelHealth | where TimeGenerated > ago(24h) | where SentinelResourceType == "Data connector" | project TimeGenerated, SentinelResourceName, Status, Description, Reason | order by TimeGenerated desc

Note: No data after 30+ minutes? Check that: (1) the API key is valid and not rate-limited (HTTP 401/429), (2) your account has access to vulnerability collections, and (3) any Vulnerability filter you entered is not so narrow that it matches no objects. Disconnect and reconnect to retry after correcting the value.

Google Workspace Activities (via Codeless Connector Framework)

Supported by:Microsoft Corporation

The Google Workspace Activities data connector provides the capability to ingest Activity EventsEvents, including Gmail audit events, from the Google Workspace API into Microsoft Sentinel.

Log Analytics table(s):

• Data Collection Endpoint (URL): <variable value provided at install time>
• Data Collection Rule ID (Rule ID): <variable value provided at install time>

Holm Security Asset Data (using Azure Functions)Connector

Supported by:Holm Security

The Holm Security data connector provides the capability to pollingest Holm Security asset data into Microsoft Sentinel through the REST API. The connector provides the ability to get web and network assets data from Holm Security Center into Microsoft Sentinel.Security.

Log Analytics table(s):

Data collection rule support: Not currently supported

Prerequisites:

• Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. For more information, see Azure Functions.
• Holm Security API Tokenaccess: A Holm Security API Tokentoken is required. Holm Security API TokenSee how to set up an API token.

Setup Instructions:

NOTE:1. Configuration This connector uses Azure Functions to connect to a

Acquire your token from your Holm Security Assets to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the Azure Functions pricing pageuser profile. For details, visit https://se-api.holmsecurity.com/docs/v2/#section/Authentication

• API Key: (API key for details.

authentication)

        setClaim('tenant_id', TenantData.Get("CybrTenantID"));	setClaim('aud', 'cyberark.isp.audit');

[aka.ms](https://aka.ms/sentinel-infoblox-azuredeploy)

*Note: It is recommended to install the AMA agent v1.27 at minimum. [Learn more](/en-us/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal) and ensure there is no duplicate DCR as it can cause log duplication.*

f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App

g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (for example, `https:(e.g. https://api.services.mimecast.com`)com)

h. MimecastClientID - Enter Mimecast Client ID for authentication


f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App

g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (for example, `https:(e.g. https://api.services.mimecast.com`)com)

h. MimecastClientID - Enter Mimecast Client ID for authentication


f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App

g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (for example, `https:(e.g. https://api.services.mimecast.com`)com)

h. MimecastClientID - Enter Mimecast Client ID for authentication


f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App

g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (for example, `https:(e.g. https://api.services.mimecast.com`)com)

h. MimecastClientID - Enter Mimecast Client ID for authentication


f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App

g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (for example, `https:(e.g. https://api.services.mimecast.com`)com)

h. MimecastClientID - Enter Mimecast Client ID for authentication

The DCR's KQL transform promotes `id`, `type`, `module`, `risk_level`, `asset.type`/`source_type`, `asset.value`/`asset_value`, `tags`, and the appropriate timestamp (`date_added` for leaked-data/dark-web/domain-permutation, `detected_at` for attack-surface)`tags` into typed columns. `TimeGenerated` is set to the ingestion time so historical events are never dropped by retention checks, while the original event timestamp (`detected_at` for attack-surface/domain-permutation, `date_added` otherwise) is preserved in `EventTime`. Everything else is preserved in the dynamic `Details` column.

**3. Verify data ingestion**


Follow [guidance](https://orcasecurity.zendesk.com/hc/articles/360043941992-Azure-Sentinel-configuration) for integrating Orca Security Alerts logs with Microsoft Sentinel.

- **Workspace ID**: <variable value provided at install time>
- **Primary Key**: <variable value provided at install time>

**Palo Alto Cortex XDR*Orca Security Alerts (via Microsoft Entra ID)**

**Supported by:**[Microsoft Corporation]Orca Security](https://support.microsoft.com/docs.orcasecurity.io/)

The [Palo[Orca Security](https://orca.security/) Alerts connector lets you stream Orca cloud security alerts into Microsoft Sentinel. Orca pushes alerts to the Logs Ingestion API of a Data Collection Endpoint using a Microsoft Entra ID application, replacing the legacy Log Analytics Shared Key authentication.

**Log Analytics table(s):**

| Table | DCR support | Lake-only ingestion |
| --- | --- | --- |
| `OrcaAlerts_CL` | Yes | Yes |

**Data collection rule support:**[Workspace transform DCR](/en-us/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)

**Prerequisites:**

- **Microsoft Entra ID**: Permission to create an app registration in Microsoft Entra ID (if using the auto-created app). Typically requires the Application Developer role or higher.
- **Microsoft Azure**: Permission to create and configure Azure resources (DCE, DCR, table) and assign RBAC roles. Typically requires the Contributor and User Access Administrator roles.
- **Orca Security**: Access to the Orca Security platform to configure the Microsoft Sentinel integration.

**Setup Instructions:**

**1. Deploy connector resources**

Deploy the Azure resources required to ingest Orca Security alerts via the Logs Ingestion API using Microsoft Entra ID authentication.

Choose your deployment option

### Option A: Auto-create a Microsoft Entra application (Recommended)

Clicking **Deploy Orca Security Alerts Connector** automatically creates:

- A Data Collection Endpoint (DCE)
- A Data Collection Rule (DCR) with the Orca alerts stream
- The Log Analytics table (OrcaAlerts\_CL)
- A Microsoft Entra application with a client secret
- The role assignment (Monitoring Metrics Publisher) on the DCR

**After deployment:** the Tenant ID, Client ID, Client Secret, DCE URI and DCR Immutable ID are auto-populated below for copy-paste into the Orca platform.

### Option B: Use a pre-existing Microsoft Entra application (BYOA)

Clicking **Deploy Orca Security Alerts Connector creates the DCE, DCR and table, plus an Entra application you can ignore. Additional steps required:**

1. Assign your existing Entra application's service principal the **Monitoring Metrics Publisher** role on the created DCR.
2. Use your own application's Client ID and Client Secret (ignore the auto-generated ones below).
3. Use the DCE URI, DCR Immutable ID and Stream Name from below.

Click Deploy to begin:

**2. Configure the Orca Security integration**

Copy the following values into the Microsoft Sentinel integration settings in the Orca Security platform.

**For Option A (auto-created app): use all the auto-populated values below. For Option B (pre-existing app):** use the DCE URI, DCR Immutable ID and Stream Name below, but use your own application's Tenant ID, Client ID and Client Secret.

#### Azure configuration values:

- **Tenant ID**: <variable value provided at install time>
- **Application (Client) ID**: <variable value provided at install time>
- **Client Secret**: <variable value provided at install time>
- **Data Collection Endpoint (DCE) URI**: <variable value provided at install time>
- **Data Collection Rule (DCR) Immutable ID**: <variable value provided at install time>
- **Stream Name**: <variable value provided at install time>

#### Configure in the Orca Security platform

1. Log in to your **Orca Security** console.
2. Navigate to **Settings > Integrations > Microsoft Sentinel**.
3. Paste the configuration values from above (Tenant ID, Application (Client) ID, Client Secret, DCE URI, DCR Immutable ID and Stream Name).
4. Click **Save** to complete the integration.

**3. Verify data ingestion**

Confirm that alerts are flowing from Orca Security into Microsoft Sentinel.

Verification steps

1. Trigger or wait for an alert in Orca Security.
2. Wait 5-10 minutes for the data to appear in Microsoft Sentinel.
3. Run the following query to verify alerts:

```kusto
OrcaAlerts_CL
| take 10

OrcaAlerts_CL
| summarize LastLogReceived = max(TimeGenerated)
| project IsConnected = LastLogReceived > ago(30d)