Skip to main content

Microsoft Azure Sentinel

Microsoft Azure Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform provided by Microsoft. It serves as a comprehensive security analytics and threat intelligence solution that helps organizations detect, investigate, respond to, and prevent cyber threats and security incidents across their entire enterprise environment.

CategorySIEM
DirectionQuery source
Sign-inClient Secret (Azure AD App), OAuth Access Token
Query languagesSTIX, KQL

Before you start​

Huntbase can sign in to Microsoft Azure Sentinel with any of these methods: Client Secret (Azure AD App), OAuth Access Token. Pick one, create the credential in Microsoft Azure Sentinel, then keep it to hand for the Connect step.

Client Secret (Azure AD App)​

Authenticate using an Azure AD application's tenant

  1. In the Microsoft Entra admin center, go to Entra ID › App registrations and select New registration. Choose Single tenant only, then select Register.
  2. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
  3. Go to Certificates & secrets › Client secrets › New client secret, set an expiration, select Add, and copy the secret Value right away.
  4. Go to API permissions › Add a permission › Microsoft Graph › Application permissions and add SecurityAlert.Read.All. Add SecurityEvents.Read.All as well if you query legacy alerts.
  5. Select Grant admin consent for your tenant and confirm.

Permissions:

  • SecurityAlert.Read.All (Microsoft Graph application permission, for Alerts V2)
  • SecurityEvents.Read.All (Microsoft Graph application permission, for legacy alerts)
Watch out for
  • This connection searches security alerts through the Microsoft Graph Security API, so Log Analytics workspace roles alone don't give it access. It needs the Microsoft Graph permissions above, with admin consent.
  • Microsoft retires the legacy alerts API on October 15, 2026. Turn on Include Alerts (V2) to use the newer alert schema.
  • The client secret value is never displayed again after you leave the page.

For the vendor's own instructions, see Microsoft Entra app registration documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Microsoft Azure Sentinel​

  1. Go to Connections and click New connection, or click New connection on the Microsoft Azure Sentinel product page.
  2. On Product, pick Microsoft Azure Sentinel and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Microsoft Azure Sentinel lives:

FieldRequiredNotes
Server AddressYesThe Microsoft Graph host, graph.microsoft.com, not your Sentinel workspace or portal URL. Defaults to graph.microsoft.com.
PortYes443. Defaults to 443.
Login HostYeslogin.microsoftonline.com for the global cloud. Change it only for a national cloud. Defaults to login.microsoftonline.com.

Advanced settings​

These settings are under Advanced. You can usually leave them alone.

FieldRequiredNotes
Max ResultsNoAdvanced. Max rows fetched per run (connector default 10000).
Query Timeout (seconds)NoAdvanced. Per-request timeout for the Microsoft Graph/Sentinel API (connector default 30s).
Self-Signed Cert (PEM)NoProvide a self-signed or CA-signed certificate to securely communicate with the data source.
Include AlertsNoQuery the Microsoft Sentinel SecurityAlert (legacy alert schema) table.
Include Alerts (V2)NoQuery the newer alert schema (alertV2) in addition to the legacy alert table.

Credentials​

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

Client Secret (Azure AD App)​

FieldRequiredNotes
Tenant IDYesTenant ID of Azure Active directory Application with access to the Microsoft Graph API. Secret — not shown again after you save it.
Client IDYesClient ID of Azure Active directory Application with access to the Microsoft Graph API. Secret — not shown again after you save it.
Client SecretYesThe secret Value, not the Secret ID. Secret — not shown again after you save it.

OAuth Access Token​

FieldRequiredNotes
Access TokenYesSecret — not shown again after you save it.

Query it​

Once connected, Microsoft Azure Sentinel can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.
KQLNative Kusto queries against the workspace, sent as written.

Next steps​