Microsoft Sentinel Integration Guide

Overview

The Microsoft Sentinel integration connects your NINA workflows to the Microsoft Sentinel REST API (Azure Resource Manager), enabling comprehensive cloud-native SIEM operations. This integration lets you manage incidents, alert rules, automation rules, threat intelligence indicators, watchlists, bookmarks, data connectors, and Content Hub packages — all directly from your workflows.

Microsoft Sentinel is Microsoft's cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) solution built on Azure. It ingests data at cloud scale, detects threats with built-in ML analytics, and enables automated incident response via Logic App playbooks.

Status

We currently support 25 resources covering the full Sentinel ARM API surface:

• Incident Management: Create, update, delete, and list incidents; list associated alerts, bookmarks, and entities per incident; trigger playbooks directly on an incident
• Incident Comments: Full CRUD management of comments attached to incidents
• Incident Relations: Link incidents to entities (IP addresses, accounts, hosts) or bookmarks via relation records
• Incident Tasks: Create and manage actionable tasks analysts must complete as part of incident response
• Alert Rules: Full CRUD management of all detection rule kinds (Scheduled, NRT, Fusion, MLBehaviorAnalytics, ThreatIntelligence, MicrosoftSecurityIncidentCreation)
• Alert Rule Templates: Read-only access to built-in detection rule templates
• Actions: Manage Logic App actions linked to alert rules
• Automation Rules: Full CRUD management of automation rules that standardise incident handling
• Threat Intelligence Indicators: Full CRUD management of individual TI indicators with STIX pattern support; append, replace, and query tags; retrieve aggregated metrics
• Bookmarks: Tag and annotate specific query results during investigations
• Watchlist Items: Create, update, delete, and list items within a watchlist
• Data Connectors: Manage connectors for data sources (Azure AD, Office 365, Threat Intelligence, and more)
• Data Connector Definitions: Manage schema definitions for custom data connectors
• Content Packages: Install, uninstall, retrieve, and list Content Hub solution packages
• Content Templates: Install, delete, retrieve, and list individual Content Hub templates
• Product Packages: Read-only access to the global Content Hub solution catalog
• Product Templates: Read-only access to the global Content Hub template catalog
• Metadata: Manage metadata items describing content installed in the workspace
• Security ML Analytics Settings: Manage anomaly-based ML detection settings
• Sentinel Onboarding States: Enable Sentinel on a workspace and query onboarding status
• Source Controls: Connect a workspace to a GitHub or Azure DevOps repository for content synchronisation
• Entities: Trigger Logic App playbooks on a specific Sentinel entity
• Operations: List all available operations for the Security Insights resource provider

Credential Configuration

Before using the Microsoft Sentinel integration in your workflows, you need to configure OAuth2 credentials through an Azure App Registration. The integration uses the OAuth2 client credentials flow (no user interaction required) against the Azure AD v1.0 token endpoint, with https://management.azure.com/ as the resource. All API calls go through the Azure Resource Manager (ARM) endpoint.

Unlike the Microsoft Defender for Endpoint integration — which uses API permissions defined in the App Registration manifest — the Sentinel integration uses Azure RBAC roles assigned directly to the service principal. This means permissions are granted at the Azure resource level (subscription, resource group, or workspace), not inside the App Registration itself.

Authentication Method

OAuth2 Client Credentials

Field	Description	Example
Tenant ID	Directory (tenant) ID from Azure portal	87654321-4321-4321-4321-fedcba987654
Client ID	Application (client) ID from Azure App Registration	12345678-1234-1234-1234-123456789abc
Client Secret	Client secret value from Azure App Registration	abcd1234~efgh5678ijklMNOP9012qrst.UV
Subscription ID	Azure Subscription ID containing the Sentinel workspace	aaaabbbb-cccc-dddd-eeee-ffffffffffff
Resource Group Name	Azure Resource Group containing the Log Analytics workspace	rg-sentinel-prod
Workspace Name	Log Analytics workspace name that Sentinel is attached to	law-sentinel-prod
Base URL	Azure Resource Manager base URL. Change only for sovereign clouds.	https://management.azure.com

How to create an Azure App Registration:

1. Sign in to the Azure portal
2. Navigate to Microsoft Entra ID > App registrations
3. Click New registration
4. Provide a name (e.g., "NINA Sentinel Integration")
5. Select Accounts in this organizational directory only
6. Click Register
7. Note the Application (client) ID and Directory (tenant) ID shown on the overview page
8. Go to Certificates & secrets > Client secrets > New client secret
9. Enter a description and expiration period, then click Add
10. Copy the Value immediately — it will not be shown again

Note: No API permissions need to be added to the App Registration for Microsoft Sentinel. Access is controlled entirely through Azure RBAC roles assigned to the service principal. Do not add "Azure Service Management" or any other API permissions unless your organization has a specific requirement.

How to locate your Subscription ID, Resource Group Name, and Workspace Name:

1. Sign in to the Azure portal
2. Navigate to Microsoft Sentinel
3. Select your workspace
4. In the Sentinel overview blade, the Subscription, Resource group, and Workspace are displayed at the top of the page
5. Copy all three values — they are all required for the integration credential

Alternatively, navigate to Log Analytics workspaces, open your workspace, and these values are shown in the Overview blade.

Required Azure RBAC Roles

The service principal (App Registration) must be assigned Azure RBAC roles on the Log Analytics workspace or on the resource group containing it. Granting at the resource group level covers both the workspace and any Logic Apps in the same group.

Assign roles through: Azure portal > Resource Group (or workspace) > Access control (IAM) > Add role assignment > Select role > Assign to User, group, or service principal > search for the App Registration name.

RBAC Role	ARM Role ID	Required for
Microsoft Sentinel Reader	8d289c81-5878-46d4-8554-54e1e3d8b5cb	All read operations (list, get)
Microsoft Sentinel Responder	3e150937-b8fe-4cfb-8069-0eaf05ecd056	Incident updates, comments, tasks, TI indicator management, watchlist items
Microsoft Sentinel Contributor	ab8e14d6-4a74-4a29-9ba8-549422addade	Full management: alert rules, automation rules, data connectors, bookmarks, metadata, source controls, ML settings, onboarding states, content packages/templates
Logic App Contributor	515c2055-d9d4-4321-b1b9-bd0c9a0f79fe	Required on the Logic App resource group if using incident.runPlaybook, entity.runPlaybook, or action.createOrUpdate to trigger or link Logic Apps

Minimum permission sets by use case:

Use Case	Required Roles
Read-only monitoring (list incidents, alerts, TI indicators)	Microsoft Sentinel Reader
Incident response (update incidents, add comments, tasks, run playbooks)	Microsoft Sentinel Reader + Microsoft Sentinel Responder
Full SOC automation (create/update rules, connectors, TI, watchlists)	Microsoft Sentinel Contributor
Playbook triggering via workflows	Microsoft Sentinel Responder + Logic App Contributor (on Logic App RG)

Important: Microsoft Sentinel Contributor includes all permissions from Responder and Reader. Grant the least privilege required for your workflows. Do not grant Owner or Contributor (the generic ARM roles) — they are broader than needed and violate least-privilege principles.

Sovereign Cloud Environments

If your organization uses a government or sovereign cloud, override the Base URL credential field with the appropriate endpoint:

Cloud	Base URL
Azure Commercial (default)	https://management.azure.com
Azure US Government	https://management.usgovcloudapi.net
Azure China	https://management.chinacloudapi.cn

The Azure AD token endpoint also changes for sovereign clouds:

Cloud	Azure AD Token Endpoint
Azure Commercial	https://login.microsoftonline.com/{tenantId}/oauth2/token
Azure US Government	https://login.microsoftonline.us/{tenantId}/oauth2/token
Azure China	https://login.chinacloudapi.cn/{tenantId}/oauth2/token

Note: The integration uses the Azure AD v1.0 token endpoint with resource=https://management.azure.com/ (or the sovereign cloud equivalent). Token acquisition and refresh are handled automatically.

Creating a Microsoft Sentinel Credential

1. Navigate to the Credentials section in NINA
2. Click Add New Credential
3. Fill in the credential details:
   • Name: A descriptive name (e.g., "Sentinel Production")
   • Description: Optional details about the credential's purpose
   • Integration Service: Select "Microsoft Sentinel"
   • Auth Type: Select "OAuth2"
   • Tenant ID: Enter your Directory (tenant) ID
   • Client ID: Enter your Application (client) ID
   • Client Secret: Enter your client secret value
   • Subscription ID: Enter your Azure Subscription ID
   • Resource Group Name: Enter the resource group containing your Log Analytics workspace
   • Workspace Name: Enter the Log Analytics workspace name
   • Base URL: Leave blank for Azure Commercial (defaults to https://management.azure.com)
4. Click Test Connection to verify credentials — this acquires an OAuth token from Azure AD to confirm the tenant, client ID, and secret are valid
5. Click Save to store the credential

Note: The Test Connection check only validates that a token can be acquired (tenantId, clientId, clientSecret). It does not validate that the service principal has the correct RBAC roles on the workspace. If you see Forbidden errors when running operations, verify RBAC role assignments as described above.

Supported Resources and Operations

Incident

Manage Microsoft Sentinel incidents. Incidents are the primary unit of work in Sentinel, grouping related alerts and entities for analyst investigation.

Operation	Name	Description
createOrUpdate	Create or Update Incident	Create a new incident or update an existing one
get	Get Incident	Retrieve a specific incident by its ID
list	List Incidents	Retrieve all incidents with OData filtering and pagination
delete	Delete Incident	Delete a given incident
listAlerts	List Incident Alerts	Retrieve all security alerts associated with an incident
listBookmarks	List Incident Bookmarks	Retrieve all bookmarks associated with an incident
listEntities	List Incident Entities	Retrieve all entities (IPs, accounts, hosts, etc.) associated with an incident
runPlaybook	Run Playbook on Incident	Trigger a Logic App playbook on the incident

Key parameters for createOrUpdate:

• incidentId (required) — unique GUID for the incident
• title (required) — incident title
• status (required) — New, Active, or Closed
• severity — High, Medium, Low, or Informational
• description — free-text description
• classification — required when status is Closed: Undetermined, TruePositive, BenignPositive, FalsePositive
• classificationReason — SuspiciousActivity, SuspiciousButExpected, IncorrectAlertLogic, InaccurateData
• classificationComment — free-text closure comment
• etag — provide to update an existing incident (omit to create)

Key parameters for list:

• $filter — OData filter expression (e.g., properties/status eq 'Active')
• $orderby — sort expression (e.g., properties/createdTimeUtc desc)
• $top — max incidents to return (max 1000)
• $skipToken — continuation token from nextLink for pagination

Key parameters for runPlaybook:

• incidentId (required) — the incident ID
• logicAppsResourceId (required) — full Azure resource ID of the Logic App (e.g., /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Logic/workflows/{name})
• tenantId — tenant ID of the Logic App; defaults to the current tenant if omitted

---

Incident Comment

Manage comments attached to a specific Sentinel incident.

Operation	Name	Description
createOrUpdate	Create or Update Incident Comment	Create or update a comment on an incident
get	Get Incident Comment	Retrieve a specific comment
list	List Incident Comments	Retrieve all comments for an incident with OData filtering
delete	Delete Incident Comment	Delete a comment from an incident

Key parameters for createOrUpdate:

• incidentId (required) — the parent incident ID
• incidentCommentId (required) — unique ID for the comment
• message (required) — comment text
• etag — provide to update an existing comment

Key parameters for list:

• incidentId (required) — the parent incident ID
• $filter — OData filter expression
• $orderby — sort expression (e.g., properties/createdTimeUtc desc)
• $top — max comments to return
• $skipToken — pagination continuation token

---

Incident Relation

Manage relations that link a Sentinel incident to an entity (e.g., IP address, account, host) or to a bookmark.

Operation	Name	Description
createOrUpdate	Create or Update Incident Relation	Link an entity or bookmark to an incident
get	Get Incident Relation	Retrieve a specific relation
list	List Incident Relations	Retrieve all relations for an incident
delete	Delete Incident Relation	Remove a relation from an incident

Key parameters for createOrUpdate:

• incidentId (required) — the parent incident ID
• relationName (required) — unique name for the relation (typically a GUID)
• relatedResourceId (required) — full Azure resource ID of the entity or bookmark to link
• etag — provide to update an existing relation

---

Incident Task

Manage actionable tasks assigned to analysts as part of incident response.

Operation	Name	Description
createOrUpdate	Create or Update Incident Task	Create or update a task on an incident
get	Get Incident Task	Retrieve a specific task
list	List Incident Tasks	Retrieve all tasks for an incident
delete	Delete Incident Task	Delete a task from an incident

Key parameters for createOrUpdate:

• incidentId (required) — the parent incident ID
• incidentTaskId (required) — unique ID for the task
• title (required) — task title
• description — optional task description
• status — New, Active, or Closed
• etag — provide to update an existing task

---

Alert Rule

Manage Sentinel detection rules. Alert rules define the queries and logic that generate alerts and incidents.

Operation	Name	Description
createOrUpdate	Create or Update Alert Rule	Create or update a detection rule
get	Get Alert Rule	Retrieve a specific rule by its ID
list	List Alert Rules	Retrieve all alert rules in the workspace
delete	Delete Alert Rule	Delete an alert rule

Key parameters for createOrUpdate:

• ruleId (required) — unique ID for the alert rule
• kind (required) — Scheduled, NRT, Fusion, MLBehaviorAnalytics, ThreatIntelligence, or MicrosoftSecurityIncidentCreation
• displayName — rule display name
• description — rule description
• severity — High, Medium, Low, or Informational
• enabled — true or false
• query — KQL query (required for Scheduled and NRT kinds)
• queryFrequency — how often the query runs (ISO 8601 duration, e.g., PT5M for 5 minutes)
• queryPeriod — lookback window (ISO 8601 duration, e.g., PT1H)
• triggerOperator — GreaterThan, LessThan, Equal, or NotEqual
• triggerThreshold — integer threshold for trigger condition
• etag — provide to update an existing rule

---

Alert Rule Template

Read-only access to built-in Sentinel detection rule templates. Templates can be used to create new alert rules.

Operation	Name	Description
get	Get Alert Rule Template	Retrieve a specific template by its ID
list	List Alert Rule Templates	Retrieve all available templates with OData filtering

Key parameters for list:

• $filter — OData filter expression
• $orderby — sort expression (e.g., displayName asc)
• $top — max templates to return
• $skipToken — pagination continuation token

---

Action

Manage Logic App actions linked to Sentinel alert rules. When an alert rule fires, its linked actions are triggered.

Operation	Name	Description
createOrUpdate	Create or Update Action	Link a Logic App to an alert rule
get	Get Action	Retrieve a specific action
listByAlertRule	List Actions by Alert Rule	Retrieve all actions linked to an alert rule
delete	Delete Action	Remove an action from an alert rule

Key parameters for createOrUpdate:

• ruleId (required) — the parent alert rule ID
• actionId (required) — unique ID for the action
• logicAppResourceId (required) — full Azure resource ID of the Logic App workflow
• triggerUri (required) — the HTTP callback URL of the Logic App trigger
• etag — provide to update an existing action

Note: logicAppResourceId follows the format /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Logic/workflows/{name}. The triggerUri is the trigger callback URL found in the Logic App's HTTP trigger configuration.

---

Automation Rule

Manage Sentinel automation rules. Automation rules run automatically in response to incidents to apply tags, change status, assign owners, or trigger playbooks.

Operation	Name	Description
createOrUpdate	Create or Update Automation Rule	Create or update an automation rule
get	Get Automation Rule	Retrieve a specific automation rule
list	List Automation Rules	Retrieve all automation rules in the workspace
delete	Delete Automation Rule	Delete an automation rule

Key parameters for createOrUpdate:

• automationRuleId (required) — unique GUID for the automation rule
• etag — provide to update an existing rule; all other rule-specific properties (displayName, order, triggeringLogic, actions) are passed as additional parameters and wrapped automatically in a properties object

---

Threat Intelligence Indicator

Manage individual threat intelligence (TI) indicators in Sentinel. Indicators are represented as STIX 2.1 objects.

Operation	Name	Description
create	Create	Create or fully replace a TI indicator by name (PUT)
createIndicator	Create Indicator	Create a new TI indicator from a STIX object (POST)
get	Get	Retrieve a specific indicator by its name
delete	Delete	Delete a TI indicator by its name
appendTags	Append Tags	Add tags to an indicator without removing existing tags
replaceTags	Replace Tags	Replace all tags on an indicator with a new set
queryIndicators	Query Indicators	Query indicators using filter criteria

Key parameters for create:

• name (required) — unique name (identifier) of the indicator
• kind (required) — use indicator
• pattern — STIX pattern expression (e.g., [ipv4-addr:value = '198.51.100.0'])
• patternType — pattern language (e.g., stix)
• displayName — human-readable name
• description — description of the indicator
• confidence — confidence score (0–100)
• validFrom — ISO 8601 start of validity (e.g., 2025-01-01T00:00:00Z)
• validUntil — ISO 8601 end of validity
• threatTypes — comma-separated threat types (e.g., malicious-activity,attribution)
• threatIntelligenceTags — comma-separated tags (e.g., apt29,c2,phishing)
• etag — provide to replace an existing indicator

Key parameters for createIndicator:

• Same parameters as create except no name path param — the name is system-assigned

Key parameters for appendTags / replaceTags:

• name (required) — indicator name
• threatIntelligenceTags (required) — comma-separated list of tags

Key parameters for queryIndicators:

• pageSize — max results per page
• keywords — keyword search string
• threatTypes — comma-separated threat types filter
• patternTypes — comma-separated pattern types filter (e.g., stix)
• sources — comma-separated sources filter
• ids — comma-separated indicator IDs filter
• minValidUntil / maxValidUntil — validity date range (ISO 8601)
• minCreatedTimeUtc / maxCreatedTimeUtc — creation date range (ISO 8601)

---

Threat Intelligence Indicators (Collection)

List all TI indicators in the workspace with OData filtering.

Operation	Name	Description
list	List Threat Intelligence Indicators	Retrieve all TI indicators with OData filtering and pagination

Key parameters for list:

• $filter — OData filter expression (e.g., properties/confidence gt 50)
• $orderby — sort expression (e.g., properties/createdTimeUtc desc)
• $top — max indicators to return
• $skipToken — pagination continuation token

---

Threat Intelligence Indicator Metrics

Retrieve aggregated metrics for TI indicators in the workspace.

Operation	Name	Description
list	List Threat Intelligence Indicator Metrics	Get counts grouped by indicator type, threat type, and source

No additional parameters are required.

---

Bookmark

Manage investigation bookmarks. Bookmarks allow analysts to tag specific KQL query results during threat hunting for later reference.

Operation	Name	Description
createOrUpdate	Create or Update Bookmark	Create or update a bookmark
get	Get Bookmark	Retrieve a specific bookmark
list	List Bookmarks	Retrieve all bookmarks with OData filtering
delete	Delete Bookmark	Delete a bookmark

Key parameters for createOrUpdate:

• bookmarkId (required) — unique GUID for the bookmark
• displayName (required) — display name of the bookmark
• query (required) — KQL query that produced the bookmarked results
• queryResult — optional query result snapshot
• notes — analyst notes
• labels — comma-separated labels
• eventTime — ISO 8601 event time
• queryStartTime / queryEndTime — ISO 8601 time range of the query
• etag — provide to update an existing bookmark

---

Watchlist Item

Manage individual items within a Sentinel watchlist. Watchlists are used for entity lookups, threat hunting, and alert enrichment.

Operation	Name	Description
createOrUpdate	Create or Update Watchlist Item	Create or update an item in a watchlist
get	Get Watchlist Item	Retrieve a specific watchlist item
list	List Watchlist Items	Retrieve all items in a watchlist with OData filtering
delete	Delete Watchlist Item	Delete an item from a watchlist

Key parameters for createOrUpdate:

• watchlistAlias (required) — the alias of the parent watchlist (e.g., HighValueAssets)
• watchlistItemId (required) — unique GUID for the watchlist item
• itemsKeyValue (required) — JSON object containing key-value pairs for the item's fields (e.g., {"IPAddress": "10.0.0.1", "AssetName": "DC01"})
• etag — provide to update an existing item

Key parameters for list:

• watchlistAlias (required) — the watchlist alias
• $filter — OData filter expression
• $orderby — sort expression
• $top — max items to return
• $skipToken — pagination continuation token

---

Data Connector

Manage Sentinel data connectors. Data connectors ingest security data from Microsoft services and third-party sources.

Operation	Name	Description
createOrUpdate	Create or Update Data Connector	Create or update a data connector
get	Get Data Connector	Retrieve a specific data connector
list	List Data Connectors	Retrieve all data connectors in the workspace
delete	Delete Data Connector	Delete a data connector

Key parameters for createOrUpdate:

• dataConnectorId (required) — unique GUID for the connector
• kind (required) — connector type: AzureActiveDirectory, ThreatIntelligence, Office365, AzureSecurityCenter, MicrosoftCloudAppSecurity, AzureAdvancedThreatProtection, MicrosoftDefenderAdvancedThreatProtection
• tenantId — tenant ID of the connected service (used by most connector kinds)
• etag — provide to update

---

Data Connector Definition

Manage schema definitions for custom data connectors. Introduced in API version 2024-09-01.

Operation	Name	Description
createOrUpdate	Create or Update Data Connector Definition	Create or update a connector definition
get	Get Data Connector Definition	Retrieve a specific definition
list	List Data Connector Definitions	Retrieve all definitions in the workspace
delete	Delete Data Connector Definition	Delete a definition

Key parameters for createOrUpdate:

• dataConnectorDefinitionName (required) — unique name for the definition
• kind — definition kind (e.g., Customizable)
• connectorsCount — number of connectors associated with this definition
• etag — provide to update

---

Content Package

Manage Content Hub solution packages installed in the workspace.

Operation	Name	Description
install	Install Content Package	Install a Content Hub package and deploy all included templates
get	Get Content Package	Retrieve a specific installed package
list	List Content Packages	Retrieve all installed packages with OData filtering
uninstall	Uninstall Content Package	Remove a Content Hub package from the workspace

Key parameters for install:

• packageId (required) — the Content Hub package identifier
• contentId — the content hub item ID
• contentKind — kind of content (e.g., Solution)
• version — package version to install
• installedVersion — currently installed version (for upgrades)
• contentDisplayName — display name of the package
• contentDescription — description of the package
• etag — provide to update an existing installation

---

Content Template

Manage individual Content Hub content templates installed in the workspace.

Operation	Name	Description
install	Install Content Template	Install an individual content template
get	Get Content Template	Retrieve a specific installed template
list	List Content Templates	Retrieve all installed templates with OData filtering and expansion
delete	Delete Content Template	Remove a content template from the workspace

Key parameters for get and list:

• $expand — expand nested objects: properties/mainTemplate, properties/dependantTemplates

Key parameters for install:

• templateId (required) — template identifier
• contentId — content hub item ID
• contentKind — kind of content (e.g., AnalyticsRule, Workbook, Parser, Playbook, HuntingQuery)
• version — template version to install
• displayName — display name of the template
• packageId — package ID this template belongs to
• packageVersion — package version containing the template
• etag — provide to update

---

Product Package

Read-only access to the global Content Hub solution catalog. Product packages are catalog-wide and not specific to your workspace installation.

Operation	Name	Description
get	Get Product Package	Retrieve a specific package from the catalog
list	List Product Packages	Retrieve all packages in the global catalog

Key parameters for list:

• $filter — OData filter expression
• $orderby — sort expression
• $top — max packages to return
• $skipToken — pagination continuation token
• $expand — properties/installed, properties/packagedContent

---

Product Template

Read-only access to the global Content Hub template catalog.

Operation	Name	Description
get	Get Product Template	Retrieve a specific template from the catalog
list	List Product Templates	Retrieve all templates in the global catalog

Key parameters for list:

• $filter — OData filter expression
• $orderby — sort expression
• $top — max templates to return
• $skipToken — pagination continuation token

---

Metadata

Manage metadata items that describe content installed in the workspace (source, author, version, support details).

Operation	Name	Description
create	Create Metadata	Create a metadata item for a content item
get	Get Metadata	Retrieve a specific metadata item
list	List Metadata	Retrieve all metadata items with OData filtering
update	Update Metadata	Partially update an existing metadata item
delete	Delete Metadata	Delete a metadata item

Key parameters for create:

• metadataName (required) — unique name of the metadata item
• contentId (required) — content item ID of the referenced package or template
• contentKind (required) — kind of content (e.g., AnalyticsRule, Workbook, Solution, Watchlist)
• parentId (required) — full Azure resource ID of the content item this metadata describes
• version — content version (default 1.0.0)
• displayName — display name of the content item
• etag — provide to update

Key parameters for list:

• $filter — OData filter expression
• $orderby — sort expression
• $top — max items to return
• $skip — number of items to skip (note: uses $skip, not $skipToken)

---

Security ML Analytics Setting

Manage anomaly-based machine learning detection settings in the workspace.

Operation	Name	Description
createOrUpdate	Create or Update Security ML Analytics Setting	Create or update an ML analytics setting
get	Get Security ML Analytics Setting	Retrieve a specific setting
list	List Security ML Analytics Settings	Retrieve all ML analytics settings
delete	Delete Security ML Analytics Setting	Delete an ML analytics setting

Key parameters for createOrUpdate:

• settingsResourceName (required) — unique resource name
• kind (required) — currently supported: Anomaly
• displayName — display name
• description — description
• enabled — true or false
• etag — provide to update

---

Sentinel Onboarding State

Manage the Sentinel onboarding status of a Log Analytics workspace.

Operation	Name	Description
create	Create Sentinel Onboarding State	Enable Sentinel on the workspace
get	Get Sentinel Onboarding State	Check the onboarding status
list	List Sentinel Onboarding States	List all onboarding states
delete	Delete Sentinel Onboarding State	Offboard Sentinel from the workspace

Key parameters for create:

• sentinelOnboardingStateName (required) — use default
• customerManagedKey — boolean; whether the workspace uses a customer-managed key
• etag — provide to update

---

Source Control

Connect a Sentinel workspace to a GitHub or Azure DevOps repository for content synchronisation (GitOps).

Operation	Name	Description
create	Create Source Control	Connect the workspace to a repository
get	Get Source Control	Retrieve a specific source control
list	List Source Controls	Retrieve all source controls in the workspace
delete	Delete Source Control	Disconnect and remove a source control
listRepositories	List Repositories	List repositories accessible via a source control

Key parameters for create:

• sourceControlId (required) — unique GUID
• repoType (required) — Github or AzureDevOps
• displayName (required) — display name
• description — optional description
• repoUrl — URL of the repository
• branch — branch to synchronise from
• contentTypes — comma-separated content types to sync: AnalyticRule, Workbook, HuntingQuery, Parser, Playbook, Watchlist
• etag — provide to update

---

Entity

Trigger Logic App playbooks on specific Sentinel entities. Deprecated get and list entity endpoints are not mapped.

Operation	Name	Description
runPlaybook	Run Playbook	Trigger a Logic App playbook on a specific entity

Key parameters:

• entityId (required) — the entity ID
• logicAppsResourceId (required) — full Azure resource ID of the Logic App
• tenantId — Logic App tenant ID; defaults to the current tenant

---

Operation

List all available operations for the Microsoft Security Insights resource provider. This is a global endpoint — no subscription, resource group, or workspace is required.

Operation	Name	Description
list	List Operations	List all available API operations for the Security Insights provider

No additional parameters are required.

---

Parameter Merging and Templating

The Microsoft Sentinel integration takes full advantage of NINA's parameter merging and templating capabilities.

Parameter Sources (in order of precedence)

1. Node Parameters: Parameters configured directly in the Sentinel Integration Node
2. Extracted Parameters: Parameters automatically extracted from the input data
3. Input Data: The complete input data from upstream nodes

When a Sentinel Integration Node executes:

• It combines parameters from all sources
• Node parameters take precedence over extracted parameters
• Template variables within parameters are processed using {{variable_name}} syntax
• The combined parameters are used to execute the Sentinel operation

ARM Properties Wrapper

The Sentinel API wraps most resource-specific fields inside a properties JSON object in the request body. The integration handles this automatically — you provide flat parameters, and the pre-processing layer wraps them into the correct properties structure before sending the request to ARM.

For example, when creating an incident you provide title, status, severity as flat parameters. The integration wraps them into:

{ "properties": { "title": "...", "status": "...", "severity": "..." } }

You do not need to nest parameters under properties yourself.

OData Filtering

List operations accept standard OData v4 query parameters for filtering and pagination:

Parameter	Description	Example
$filter	Filter expression	properties/status eq 'Active'
$orderby	Sort expression	properties/createdTimeUtc desc
$top	Max results (most operations: max 1000)	50
$skipToken	Pagination token from nextLink	(opaque token from previous response)
$expand	Inline-expand related objects	properties/mainTemplate

Note: Most Sentinel list operations use $skipToken (not $skip) for pagination. The metadata.list operation is an exception and uses $skip. Always use the nextLink value from a previous response to get the next page.

Example: Incident Management

Creating a New Incident

{
  "integration_service": "microsoft-sentinel",
  "resource": "incident",
  "operation": "createOrUpdate",
  "parameters": {
    "incidentId": "{{new_incident_guid}}",
    "title": "Suspicious PowerShell execution detected",
    "status": "New",
    "severity": "High",
    "description": "Encoded PowerShell command observed on {{hostname}} — possible LOLBin attack"
  }
}

Listing Active High-Severity Incidents

{
  "integration_service": "microsoft-sentinel",
  "resource": "incident",
  "operation": "list",
  "parameters": {
    "$filter": "properties/status eq 'Active' and properties/severity eq 'High'",
    "$orderby": "properties/createdTimeUtc desc",
    "$top": 50
  }
}

Closing an Incident as a True Positive

Input Data from Previous Node:

{
  "incident_id": "e54a3b2c-1d0e-9f8a-7b6c-5d4e3f2a1b0c",
  "analyst": "[email protected]",
  "current_etag": "\"7d5a0b1c-a0b2-4b3c-8d4e-5f6a7b8c9d0e\""
}

Node Configuration:

{
  "integration_service": "microsoft-sentinel",
  "resource": "incident",
  "operation": "createOrUpdate",
  "parameters": {
    "incidentId": "{{incident_id}}",
    "title": "Confirmed malware infection — {{hostname}}",
    "status": "Closed",
    "severity": "High",
    "classification": "TruePositive",
    "classificationReason": "SuspiciousActivity",
    "classificationComment": "Confirmed ransomware dropper. Endpoint isolated and reimaged. Investigated by {{analyst}}.",
    "etag": "{{current_etag}}"
  }
}

Adding a Comment to an Incident

{
  "integration_service": "microsoft-sentinel",
  "resource": "incidentComment",
  "operation": "createOrUpdate",
  "parameters": {
    "incidentId": "{{incident_id}}",
    "incidentCommentId": "{{new_comment_guid}}",
    "message": "Triage completed. Process tree confirms malicious execution chain originating from phishing attachment. Assigning to Tier 2 for containment."
  }
}

Triggering a Playbook on an Incident

{
  "integration_service": "microsoft-sentinel",
  "resource": "incident",
  "operation": "runPlaybook",
  "parameters": {
    "incidentId": "{{incident_id}}",
    "logicAppsResourceId": "/subscriptions/{{subscription_id}}/resourceGroups/rg-playbooks/providers/Microsoft.Logic/workflows/Isolate-CompromisedHost"
  }
}

Listing Entities Linked to an Incident

{
  "integration_service": "microsoft-sentinel",
  "resource": "incident",
  "operation": "listEntities",
  "parameters": {
    "incidentId": "{{incident_id}}"
  }
}

Creating an Incident Task

{
  "integration_service": "microsoft-sentinel",
  "resource": "incidentTask",
  "operation": "createOrUpdate",
  "parameters": {
    "incidentId": "{{incident_id}}",
    "incidentTaskId": "{{new_task_guid}}",
    "title": "Collect memory dump from affected host",
    "description": "Use the MDE investigation package action to collect forensic data from the compromised endpoint",
    "status": "New"
  }
}

Example: Threat Intelligence Management

Creating a TI Indicator from a STIX Pattern

{
  "integration_service": "microsoft-sentinel",
  "resource": "threatIntelligenceIndicator",
  "operation": "createIndicator",
  "parameters": {
    "kind": "indicator",
    "displayName": "APT29 C2 Server",
    "description": "Command-and-control IP attributed to APT29 campaign targeting financial sector",
    "pattern": "[ipv4-addr:value = '198.51.100.42']",
    "patternType": "stix",
    "confidence": 90,
    "validFrom": "2026-01-01T00:00:00Z",
    "validUntil": "2026-12-31T00:00:00Z",
    "threatTypes": "malicious-activity,attribution",
    "threatIntelligenceTags": "apt29,c2,financial-sector"
  }
}

Creating or Replacing a TI Indicator by Name

Input Data:

{
  "indicator_name": "ioc-malware-hash-2026-042",
  "sha256_pattern": "[file:hashes.'SHA-256' = 'e3b0c44298fc1c149afbf4c8996fb924...']",
  "malware_family": "BlackCat",
  "valid_until": "2026-09-30T00:00:00Z"
}

Node Configuration:

{
  "integration_service": "microsoft-sentinel",
  "resource": "threatIntelligenceIndicator",
  "operation": "create",
  "parameters": {
    "name": "{{indicator_name}}",
    "kind": "indicator",
    "displayName": "{{malware_family}} malware hash",
    "description": "Confirmed {{malware_family}} sample identified in incident 2026-042",
    "pattern": "{{sha256_pattern}}",
    "patternType": "stix",
    "confidence": 95,
    "validFrom": "2026-06-01T00:00:00Z",
    "validUntil": "{{valid_until}}",
    "threatTypes": "malicious-activity",
    "threatIntelligenceTags": "ransomware,blackcat"
  }
}

Querying Indicators by Threat Type

{
  "integration_service": "microsoft-sentinel",
  "resource": "threatIntelligenceIndicator",
  "operation": "queryIndicators",
  "parameters": {
    "threatTypes": "malicious-activity",
    "patternTypes": "stix",
    "minValidUntil": "2026-06-15T00:00:00Z",
    "pageSize": 100
  }
}

Appending Tags to an Indicator

{
  "integration_service": "microsoft-sentinel",
  "resource": "threatIntelligenceIndicator",
  "operation": "appendTags",
  "parameters": {
    "name": "{{indicator_name}}",
    "threatIntelligenceTags": "confirmed-active,tier1"
  }
}

Listing All TI Indicators with High Confidence

{
  "integration_service": "microsoft-sentinel",
  "resource": "threatIntelligenceIndicators",
  "operation": "list",
  "parameters": {
    "$filter": "properties/confidence gt 75",
    "$orderby": "properties/createdTimeUtc desc",
    "$top": 200
  }
}

Getting TI Metrics Summary

{
  "integration_service": "microsoft-sentinel",
  "resource": "threatIntelligenceIndicatorMetrics",
  "operation": "list",
  "parameters": {}
}

Example: Alert Rules and Automation

Creating a Scheduled Alert Rule

{
  "integration_service": "microsoft-sentinel",
  "resource": "alertRule",
  "operation": "createOrUpdate",
  "parameters": {
    "ruleId": "{{new_rule_guid}}",
    "kind": "Scheduled",
    "displayName": "Impossible Travel — Successful Sign-In",
    "description": "Detects sign-ins from two geographically distant locations within a short time window",
    "severity": "Medium",
    "enabled": "true",
    "query": "SigninLogs | where ResultType == 0 | summarize Locations = makeset(Location) by UserPrincipalName | where array_length(Locations) > 1",
    "queryFrequency": "PT1H",
    "queryPeriod": "PT1H",
    "triggerOperator": "GreaterThan",
    "triggerThreshold": "0"
  }
}

Listing All Enabled Alert Rules

{
  "integration_service": "microsoft-sentinel",
  "resource": "alertRule",
  "operation": "list",
  "parameters": {}
}

Linking a Logic App Action to an Alert Rule

{
  "integration_service": "microsoft-sentinel",
  "resource": "action",
  "operation": "createOrUpdate",
  "parameters": {
    "ruleId": "{{rule_id}}",
    "actionId": "{{new_action_guid}}",
    "logicAppResourceId": "/subscriptions/{{subscription_id}}/resourceGroups/rg-playbooks/providers/Microsoft.Logic/workflows/Notify-SOC-Teams",
    "triggerUri": "{{logic_app_trigger_callback_url}}"
  }
}

Listing Alert Rule Templates by Kind

{
  "integration_service": "microsoft-sentinel",
  "resource": "alertRuleTemplate",
  "operation": "list",
  "parameters": {
    "$filter": "kind eq 'Scheduled'",
    "$top": 100
  }
}

Example: Watchlist Operations

Adding an Item to a Watchlist

{
  "integration_service": "microsoft-sentinel",
  "resource": "watchlistItem",
  "operation": "createOrUpdate",
  "parameters": {
    "watchlistAlias": "HighValueAssets",
    "watchlistItemId": "{{new_item_guid}}",
    "itemsKeyValue": "{\"Hostname\": \"{{hostname}}\", \"Owner\": \"{{owner}}\", \"CriticalityLevel\": \"Tier1\"}"
  }
}

Listing Items in a Watchlist

{
  "integration_service": "microsoft-sentinel",
  "resource": "watchlistItem",
  "operation": "list",
  "parameters": {
    "watchlistAlias": "HighValueAssets",
    "$filter": "properties/itemsKeyValue/CriticalityLevel eq 'Tier1'",
    "$top": 500
  }
}

Removing an Item from a Watchlist

{
  "integration_service": "microsoft-sentinel",
  "resource": "watchlistItem",
  "operation": "delete",
  "parameters": {
    "watchlistAlias": "HighValueAssets",
    "watchlistItemId": "{{item_id_to_remove}}"
  }
}

Example: Investigation Bookmarks

Creating a Bookmark from a Hunting Query Result

{
  "integration_service": "microsoft-sentinel",
  "resource": "bookmark",
  "operation": "createOrUpdate",
  "parameters": {
    "bookmarkId": "{{new_bookmark_guid}}",
    "displayName": "Suspicious Base64 PowerShell — {{hostname}}",
    "query": "SecurityEvent | where EventID == 4688 | where CommandLine contains 'encodedcommand'",
    "queryResult": "{{query_result_snapshot}}",
    "notes": "Observed encoded PowerShell execution. Possible C2 staging. Correlate with network logs.",
    "labels": "hunting,powershell,possible-c2",
    "eventTime": "{{event_time}}",
    "queryStartTime": "2026-06-15T00:00:00Z",
    "queryEndTime": "2026-06-15T12:00:00Z"
  }
}

Example: Content Hub

Installing a Content Hub Package

{
  "integration_service": "microsoft-sentinel",
  "resource": "contentPackage",
  "operation": "install",
  "parameters": {
    "packageId": "Microsoft Defender for Endpoint",
    "contentId": "Microsoft Defender for Endpoint",
    "contentKind": "Solution",
    "version": "3.0.0"
  }
}

Listing Installed Content Packages

{
  "integration_service": "microsoft-sentinel",
  "resource": "contentPackage",
  "operation": "list",
  "parameters": {
    "$orderby": "properties/displayName asc",
    "$top": 100
  }
}

Searching the Global Content Hub Catalog

{
  "integration_service": "microsoft-sentinel",
  "resource": "productPackage",
  "operation": "list",
  "parameters": {
    "$filter": "properties/categories/domains/any(d: d eq 'Identity')",
    "$top": 50
  }
}

Incident Field Reference

Incident Status Values

Value	Description
New	Newly created incident not yet triaged
Active	Incident is under investigation
Closed	Incident investigation completed

Incident Severity Values

Value	Description
High	High-severity incident requiring urgent response
Medium	Medium-severity incident requiring prompt response
Low	Low-severity incident
Informational	Informational incident

Incident Classification Values (used when closing)

Value	Description
Undetermined	Classification not yet determined
TruePositive	Confirmed security incident
BenignPositive	Expected or known benign activity
FalsePositive	Not a security incident

Incident Classification Reason Values

Value	Applicable Classification
SuspiciousActivity	TruePositive
SuspiciousButExpected	BenignPositive
IncorrectAlertLogic	FalsePositive
InaccurateData	FalsePositive

Incident Task Status Values

Value	Description
New	Task not yet started
Active	Task is in progress
Closed	Task completed

Alert Rule Kind Values

Kind	Description
Scheduled	KQL query run on a schedule
NRT	Near-real-time KQL query
Fusion	Multi-stage attack detection (built-in)
MLBehaviorAnalytics	ML-based behavior analytics (built-in)
ThreatIntelligence	Matches TI indicators against ingested logs
MicrosoftSecurityIncidentCreation	Creates incidents from Microsoft security product alerts

Trigger Operator Values

Value	Meaning
GreaterThan	Alert fires when result count > threshold
LessThan	Alert fires when result count < threshold
Equal	Alert fires when result count = threshold
NotEqual	Alert fires when result count ≠ threshold

Source Control Repo Type Values

Value	Description
Github	GitHub repository
AzureDevOps	Azure DevOps (Repos) repository

Common Workflow Patterns

Automated Incident Response

1. incident.list with $filter: properties/status eq 'New' and properties/severity eq 'High' — retrieve new high-severity incidents
2. incident.listAlerts — retrieve associated alerts for each incident
3. incident.listEntities — retrieve entities (IPs, accounts, hosts) for enrichment
4. incident.runPlaybook — trigger a containment playbook
5. incidentComment.createOrUpdate — log investigation findings as a comment
6. incidentTask.createOrUpdate — create remediation tasks for the analyst
7. incident.createOrUpdate with status: Active — assign the incident to the analyst

Threat Intelligence Lifecycle

1. Receive a new IoC (IP, domain, file hash) from an upstream node or threat feed
2. threatIntelligenceIndicator.queryIndicators — check if indicator already exists
3. threatIntelligenceIndicator.createIndicator — create if new; includes STIX pattern, confidence, validity period
4. threatIntelligenceIndicator.appendTags — tag with campaign or threat actor labels
5. threatIntelligenceIndicatorMetrics.list — periodically report on TI coverage by type and source
6. On expiry: threatIntelligenceIndicator.delete — clean up expired indicators

SOC Reporting and Posture

1. incident.list with $filter: properties/createdTimeUtc ge {{start_of_week}} — retrieve this week's incidents
2. incident.list with $filter: properties/status eq 'Closed' and properties/classification eq 'TruePositive' — count confirmed incidents
3. threatIntelligenceIndicatorMetrics.list — get TI indicator coverage summary
4. alertRule.list — audit enabled detection rules
5. contentPackage.list — audit installed Content Hub solutions

Alert Rule Management

1. alertRuleTemplate.list with $filter: kind eq 'Scheduled' — discover available detection templates
2. alertRuleTemplate.get — retrieve template details and KQL query
3. alertRule.createOrUpdate with kind: Scheduled — create a rule based on the template
4. action.createOrUpdate — link a Logic App notification playbook to the new rule
5. automationRule.createOrUpdate — create an automation rule to auto-assign incidents from this rule

Watchlist-Driven Enrichment

1. watchlistItem.list with the alias of your enrichment watchlist — retrieve reference data (e.g., known malicious IPs)
2. In a downstream node, compare incident entities against the watchlist values
3. incidentComment.createOrUpdate — add a comment with the enrichment result
4. If a match is found: incident.createOrUpdate with elevated severity — escalate the incident

Troubleshooting

Issue	Resolution
Azure AD token error [invalid_client]	Verify that Client ID and Client Secret are correct and that the secret has not expired
Azure AD token error [unauthorized_client]	Confirm that the App Registration exists in the correct tenant and that you are using the https://management.azure.com/ resource (not the MDE endpoint)
Sentinel API error [AuthorizationFailed]	The service principal has no RBAC role on the workspace or resource group. Assign at minimum Microsoft Sentinel Reader for read operations or Microsoft Sentinel Contributor for write operations
Sentinel API error [ResourceNotFound]	Verify the subscriptionId, resourceGroupName, and workspaceName credential fields are correct. Names are case-sensitive
Sentinel API error [ResourceGroupNotFound]	The resource group name in the credential does not exist in the specified subscription
Sentinel API error [WorkspaceNotFound]	The Log Analytics workspace does not exist or Sentinel is not enabled on it. Use sentinelOnboardingState.get to verify Sentinel is onboarded
incidentId is required or title is required	These fields are required for incident.createOrUpdate. Provide both even when updating an existing incident
etag conflict errors (PreconditionFailed)	The etag you provided does not match the current resource state (someone else updated the resource). Re-fetch the resource with get to obtain the current etag and retry
Playbook run fails with Forbidden	The service principal needs Logic App Contributor on the resource group containing the Logic App, in addition to Microsoft Sentinel Responder
logicAppsResourceId is required	For runPlaybook and action.createOrUpdate, the Logic App resource ID must be the full ARM path: /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Logic/workflows/{name}
Pagination returning incomplete results	Sentinel list operations use $skipToken (not $skip). Extract the nextLink field from the previous response and pass the token portion as $skipToken
metadata.list not returning next page	metadata.list uses $skip (integer offset), not $skipToken. Use $skip=100 for the second page, $skip=200 for the third, etc.
threatIntelligenceTags format errors	Provide tags as a comma-separated string (e.g., "apt29,c2,phishing"). The integration converts this to a JSON array before sending to the API
itemsKeyValue format errors	itemsKeyValue must be a valid JSON object string (e.g., "{\"IP\": \"10.0.0.1\"}")
Rate limit errors (HTTP 429)	The integration retries automatically up to 3 times with exponential back-off (1 s, 2 s, 4 s). The Retry-After header is honoured when present
Empty body (success: true)	DELETE operations return HTTP 204 with no body. The integration normalises this to {"success": true} — check for this key in downstream nodes
Token expiry issues	The integration caches tokens and refreshes them automatically with a 60-second safety buffer. Recreate the credential if persistent auth errors occur
etag not required errors	For createOrUpdate operations, omit etag entirely when creating a new resource. Providing an etag on a resource that does not yet exist causes a conflict error

Best Practices

1. Assign the least-privilege RBAC role: Use Microsoft Sentinel Reader for read-only workflows, Microsoft Sentinel Responder for incident management, and Microsoft Sentinel Contributor only when creating or modifying rules, connectors, and content. Avoid generic ARM Contributor or Owner.

2. Scope RBAC to the workspace, not the subscription: Assign RBAC roles at the resource group level (containing only the Sentinel workspace) rather than the subscription to limit the blast radius if the service principal is compromised.

3. Rotate client secrets before expiry: Azure App Registration client secrets expire. Set calendar reminders and update the NINA credential before the secret expires to prevent workflow failures. Secrets can be 6 months, 1 year, 2 years, or custom durations.

4. Always provide etag for updates: Most createOrUpdate operations support optimistic concurrency via etag. Fetch the resource with get first to obtain the current etag, then pass it on the update. This prevents overwriting changes made concurrently by other processes or users.

5. Use GUIDs for resource IDs: incidentId, bookmarkId, automationRuleId, watchlistItemId, and similar ID fields must be valid GUIDs. Generate a new GUID upstream in your workflow and pass it as a template variable.

6. Set validity periods on TI indicators: Indicators without validUntil remain active indefinitely. Always set validUntil based on your threat intelligence confidence window. Implement cleanup workflows to delete expired indicators.

7. Use queryIndicators for targeted TI lookups: For searching indicators by threat type, pattern, or confidence, prefer threatIntelligenceIndicator.queryIndicators (POST with filter criteria) over threatIntelligenceIndicators.list with OData — it is more expressive and performs better on large indicator sets.

8. Paginate large result sets with $skipToken: Most Sentinel list operations cap at 1000 results and return a nextLink field when more results are available. Extract the $skipToken from nextLink and use it in the next call to page through large datasets.

9. Test with operation.list after configuring credentials: The operation.list resource is a global provider endpoint that requires only a valid token (no workspace RBAC roles). Use it to verify that the credential token acquisition is working before testing workspace-scoped operations.

10. Specify kind correctly for alert rules: The kind discriminator determines the schema of the alert rule. Scheduled and NRT rules require query, queryFrequency, queryPeriod, triggerOperator, and triggerThreshold. Fusion and MLBehaviorAnalytics rules cannot be created via the API — only enabled/disabled.

11. Log action and playbook resource IDs carefully: logicAppResourceId and triggerUri for action.createOrUpdate must be exact. The resource ID must follow the full ARM path format; the triggerUri is the HTTP POST callback URL from the Logic App trigger — not the Logic App's overview URL.

12. Use $skipToken from nextLink, not manual construction: Do not attempt to construct $skipToken values manually. Always copy the exact token from the nextLink field in the previous response. Tokens are opaque and non-sequential.

13. Include classification when closing incidents: When setting status to Closed, always provide classification (TruePositive, FalsePositive, BenignPositive, or Undetermined). Also provide classificationReason and classificationComment for audit trail completeness.

14. Use template variables for dynamic IDs: Use {{variable_name}} syntax to pass incident IDs, watchlist aliases, playbook resource IDs, and other values from upstream nodes. Avoid hardcoding IDs in node configurations.

15. Handle 204 No Content responses: DELETE operations return no body. The integration normalises this to {"success": true} — check for this key in downstream nodes rather than parsing a full response object.

Security Considerations

1. Protect client secrets: Store credentials exclusively through NINA's credential manager. Never include Client IDs, client secrets, subscription IDs, or resource group names in workflow parameters, comments, or log output.

2. Use a dedicated service principal: Register a dedicated Azure App for this integration rather than reusing credentials across multiple systems. This limits the blast radius if the credentials are compromised and makes audit logs easier to attribute.

3. Restrict resource group access: Assign RBAC roles at the resource group level (not subscription level) so the service principal can only access the specific workspace and its associated resources.

4. Audit role assignments periodically: Review the service principal's RBAC assignments in Azure portal > IAM > Role assignments. Remove any roles that are no longer required for your active workflows.

5. Review automation rule and playbook changes: Automation rules and Logic App actions have direct operational impact — they can change incident status, assign incidents, and trigger external workflows. Implement workflow-level approval gates for changes to these resources and log all modifications for audit purposes.

6. Validate TI indicator accuracy before creation: Incorrectly created threat intelligence indicators can generate false-positive alerts across the entire workspace. Verify indicator values and confidence levels in your workflow before calling threatIntelligenceIndicator.create or createIndicator.

7. Monitor watchlist modifications: Watchlists are used for enrichment and allow-listing in KQL queries and automation rules. Unauthorized additions or deletions to watchlists can suppress legitimate alerts or produce incorrect enrichment results. Audit watchlist changes regularly.

8. Be cautious with sentinelOnboardingState.delete: Deleting the onboarding state offboards Sentinel from the workspace, stopping all data collection, alert generation, and incident creation. This operation should never appear in automated workflows without an explicit approval gate.

9. Scope source control content types: When creating source controls, limit contentTypes to only the content kinds your CI/CD pipeline manages (e.g., AnalyticRule,HuntingQuery). Avoid allowing Playbook sync via source control unless your pipeline has been tested in a non-production workspace.

Updated: 2026-06-15