Security / SIEM
Microsoft Sentinel
Receive Microsoft Sentinel security alerts as classified security incidents — severity and MITRE ATT&CK tactics both drive the classification — and keep incident status in sync with the linked Sentinel incident.
BidirectionalData residency: EU
Request a demoWhat it does
- security.alert.high/medium/low → incident, with Sentinel's severity mapped to platform severity and a tenant-configurable inbound floor (default: High only opens a ticket)
- MITRE ATT&CK tactics escalate the classification: credential access, lateral movement, and command-and-control push toward confirmed_threat; exfiltration or impact escalate straight to breach
- security.incident lifecycle sync is bidirectional: our status pushes to Sentinel, and a Sentinel close classification (true/benign/false positive) refines our security classification
- Signed inbound webhook (HMAC-SHA256) is the primary path; Graph Security API polling is the fallback
- Authenticates via an Entra ID app registration (client-credentials grant), not interactive OAuth
Data residency
Conservative default; the tenant declares where their Log Analytics workspace actually lives, and a non-EU declaration is gated by the residency acknowledgement.
Event mappings
| External event | Maps to | What happens |
|---|---|---|
| security.alert.high | incident | High-severity Sentinel alert → security incident (confirmed_threat or higher) |
| security.alert.medium | incident | Medium-severity Sentinel alert → security incident (suspicious) |
| security.alert.low | incident | Low-severity Sentinel alert → security incident (low_risk) |
| security.incident | incident | Sentinel incident lifecycle → linked incident state (bidirectional) |
What you configure
- Entra tenant ID + app registration client ID
- Azure subscription ID + resource group + Log Analytics workspace name/ID
- Azure cloud instance (public / usgov / china)
- Workspace data residency (eu/us/hybrid, tenant-declared)
- Minimum inbound severity to open an incident (default High)
OAuth scopes requested
- https://graph.microsoft.com/.default
Setup overview
Register an Entra ID app with Graph Security permissions, and declare your workspace's residency. The signed webhook is the primary inbound path; polling is a fallback for tenants who don't wire it.
Related features
See TENSOR running on your own estate.
30 minutes, screen-shared, no slides. Bring the process you are least sure we handle and we will start there.