Microsoft Sentinel

The Microsoft Sentinel Connector enables integration of incidents from Microsoft Sentinel into DNIF by securely pulling data through the Microsoft Sentinel RESTful API. This ensures effective monitoring and correlation of Sentinel incidents in DNIF.

Prerequisites

To configure the Microsoft Sentinel Connector, ensure you have the following:

• Tenant ID
• Client ID
• Client Secret
• Subscription ID
• Workspace Name
• Resource Group Name

How to Derive the Prerequisites

• Register a Microsoft Entra ID Application:
  • Log in to the Azure portal using your Microsoft account.
  • Navigate to Microsoft Entra ID > App Registrations and select New Registration.
  • Provide a name for the application and select the Supported Account Types. 
  • After registration, note the Application (Client) ID.
    
    
    
    

• Configure API Permissions:
  • Go to the registered application and navigate to API Permissions.
  • Click Add a permission, select Azure Monitor, and assign the user_impersonation permission.
  • Click Grant Admin Consent to approve the permissions.
    
    
    
    

• Generate a Client Secret:
  • Navigate to the Certificates & Secrets section within the registered application.
  • Click New Client Secret, provide a description, and set an expiration duration.
  • Save the secret value displayed, as it will not be retrievable later.
    
    
    
    

• Retrieve Workspace Details:
  • Open Microsoft Sentinel in the Azure portal.
  • Select your Log Analytics Workspace and copy the Workspace ID and Primary Key under the Agents Management section.
  • Note the Subscription ID, Resource Group Name, and Workspace Name from the Microsoft Sentinel settings.
    
• Assign the Required Role:
  • Open your Microsoft Sentinel Default Directory.
  • Click on the respective Resource Group.
  • Navigate to Access Control (IAM), then click Add and select Add Role Assignment.
  • Search for the role “Microsoft Sentinel Reader” and select it.
  • Click Next, then in the Members Section, click Select Member.
  • Search for your registered application (the one configured earlier) and click Select.
  • Finally, click Review + Assign to complete the role assignment.
    
    
    
    

Configurations

Use the following fields to configure the Microsoft Sentinel Connector in DNIF:

Field	Description
Connector Name	Provide a name for the connector.
Tenant ID	The Tenant ID of the respective tenant.
Client ID	The Application (client) ID of the registered application.
Client Secret	The client secret value of the generated certificate of the respective application.
Subscription ID	Subscription ID of your respective Azure Subscription.
Workspace Name	Enter the name of your Sentinel Log Analytics workspace.
Resource Group Name	Specify the Resource Group to which your respective Sentinel Log Analytics workspace belongs.

• Click Save after entering all the required details and click Test Connection, to test the configuration.
• A Connection successful message will be displayed on screen along with the time stamp.

If the connection is not successful, an error message will be displayed. Refer Troubleshooting Connector Validations for more details on the error message.