Microsoft Sentinel
Synopsis
Creates a collector that fetches security incidents from Microsoft Sentinel workspaces. Director polls the source system's API at configured intervals to retrieve log and telemetry data rather than receiving pushed events. Supports authentication, batch processing, and automatic incident tracking with incremental updates.
Schema
- id: <numeric>
name: <string>
description: <string>
type: sentinel
tags: <string[]>
pipelines: <pipeline[]>
status: <boolean>
properties:
tenant_id: <string>
client_id: <string>
client_secret: <string>
subscription_id: <string>
resource_group_name: <string>
workspace_name: <string>
batch_size: <numeric>
Configuration
The following fields are used to define the device:
Device
| Field | Required | Default | Description |
|---|---|---|---|
id | Y | Unique identifier | |
name | Y | Device name | |
description | N | - | Optional description |
type | Y | Must be sentinel | |
tags | N | - | Optional tags |
pipelines | N | - | Optional pre-processor pipelines |
status | N | true | Enable/disable the device |
Azure Authentication
| Field | Required | Default | Description |
|---|---|---|---|
tenant_id | N* | Azure tenant ID | |
client_id | N* | Azure client ID | |
client_secret | N* | Azure client secret | |
subscription_id | Y | Azure subscription ID |
* = Omit all three to authenticate with a Managed Identity. See below.
Managed Identity Authentication
Azure targets support Managed Identity authentication for credential-free access when Director is deployed on Azure infrastructure.
How it works: When tenant_id, client_id, and client_secret are omitted from the configuration, the target automatically uses Azure's DefaultAzureCredential, which attempts authentication in the following order:
- Environment variables (
AZURE_TENANT_ID,AZURE_CLIENT_ID,AZURE_CLIENT_SECRET) - Workload Identity (for Kubernetes deployments)
- Managed Identity (system-assigned or user-assigned)
- Azure CLI credentials
- Azure PowerShell credentials
Deployment requirement: Director must run on Azure infrastructure that supports Managed Identity:
- Azure Virtual Machines
- Azure App Service
- Azure Container Instances
- Azure Kubernetes Service (AKS)
- Azure Functions
Required permissions: The Managed Identity must be granted the appropriate Azure RBAC roles documented in each target's IAM Permissions section.
Managed Identity eliminates credential management overhead and is the recommended authentication method for Azure-hosted Director deployments.
Workspaces
| Field | Required | Default | Description |
|---|---|---|---|
resource_group_name | Y | Azure resource group name | |
workspace_name | Y | Log Analytics workspace name |
Collection
| Field | Required | Default | Description |
|---|---|---|---|
batch_size | N | 10000 | Number of incidents to fetch per batch |
Details
IAM Permissions
The service principal requires the following Azure RBAC role:
| Azure Role | Scope | Purpose |
|---|---|---|
Microsoft Sentinel Reader | Log Analytics Workspace | Read incidents from Microsoft Sentinel |
The device is strictly read-only — it only lists incidents using Microsoft.SecurityInsights/incidents/read. No create, update, or delete operations are performed.
Assign the role at the Log Analytics Workspace level rather than the subscription or resource group level for least-privilege access.
Incidents
The collector captures comprehensive incident data including basic incident details (ID, title, description), severity and status, classification and labels, owner information, temporal data (create, modify, activity dates and times), and information on resources.
Incremental Updates
The collector tracks the last processed incident's timestamp, fetches only new incidents since the last checkpoint, orders incidents by creation time, and supports batch processing.
Normalization
Incidents are automatically normalized with ECS field mapping in addition to using consistent timestamp formats, structured label handling, and owner information. (See Appendix for details of ECS.)
Examples
Basic
Creating a simple Sentinel collector... | |
High-Volume
Optimizing for high incident volumes... | |
Pipelines
Applying custom processing to incidents... | |
Multiple Workspaces
Configuring multiple workspace collectors... | |
Incident Fields
The collector maps incident fields to standardized ECS fields:
| Sentinel Field | ECS Field | Description |
|---|---|---|
Title | event.name | Incident title |
Description | event.description | Incident description |
Severity | event.severity | Incident severity level |
Status | event.outcome | Current incident status |
IncidentNumber | event.sequence | Sequential incident number |
IncidentURL | url.original | Link to the incident in the portal |
Classification | event.classification | Incident classification |
ClassificationReason | event.classification_reason | Why that classification was applied |
ClassificationComment | event.reason | Free-text comment on the classification |
CreatedTime | event.created | Incident creation time |
LastModifiedTime | event.last_modified | Last update time |
FirstActivityTime | event.start | First detected activity |
LastActivityTime | event.end | Latest detected activity |
OwnerAssignedTo | user.name | Assigned owner name |
OwnerEmail | user.email | Assigned owner email |
OwnerUserPrincipalName | user.principal_name | Assigned owner UPN |
OwnerObjectID | user.id | Assigned owner object ID |
ResourceID | cloud.resource_id | Azure resource ID |
ResourceName | cloud.resource_name | Azure resource name |
ResourceType | cloud.resource_type | Azure resource type |
Etag | cloud.resource_version | Resource version (ETag) |
Labels | labels | Incident labels |
All timestamps are normalized at nanosecond level in UTC.