> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/destinations/microsoft-sentinel.md).

# Microsoft Sentinel

The Microsoft Sentinel destination exports logs from Bindplane to [Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/overview) (Azure Log Analytics) using the [Logs Ingestion API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview). Logs are delivered through a Data Collection Rule (DCR) to either a single custom table (Basic mode) or to native Sentinel ASIM tables routed per record (ASIM mode).

### Supported Telemetry Types

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Linux    |         | ✓    |        |
| Windows  |         | ✓    |        |
| macOS    |         | ✓    |        |

### Prerequisites

* A Microsoft Entra (Azure AD) application registration with a **client ID**, **client secret**, and **tenant ID**.
* A Log Analytics workspace and a Data Collection Rule (DCR). You need the DCR ingestion **endpoint** and the DCR **rule ID** (immutable ID).
* The service principal must hold the **Monitoring Metrics Publisher** role on the DCR.
* **Basic mode:** a custom log table in the workspace, prefixed with `Custom-`.
* **ASIM mode:** the companion `asim_standardization` processor on the pipeline. It sets the `sentinel_stream_name` attribute Bindplane uses to route each record to its ASIM table.

### Configuration

<figure><img src="/files/GyHoMIQRUIrdEp09KW7L" alt="Bindplane docs - Microsoft Sentinel - image 1"><figcaption></figcaption></figure>

#### Logs

| Parameter     | Type   | Default | Description                                                                                                                                                                       |
| ------------- | ------ | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Mode          | Enum   | `basic` | Delivery mode. **Required.**<sup>1</sup>                                                                                                                                          |
| Endpoint      | String |         | **Required.** The DCR/DCE log ingestion endpoint.                                                                                                                                 |
| Client ID     | String |         | **Required.** The client ID used for authentication with Azure.                                                                                                                   |
| Client Secret | String |         | **Required.** The client secret used for authenticating with Azure. Sensitive value.                                                                                              |
| Tenant ID     | String |         | **Required.** The tenant ID used for authenticating with Azure.                                                                                                                   |
| Stream Name   | String |         | **Required when `mode` is `basic`.** Name of the custom log table in the Log Analytics workspace. Must be prefixed with `Custom-`.                                                |
| Rule ID       | String |         | **Required.** The Data Collection Rule (DCR) ID or immutable ID. Can be overridden per record by the `sentinel_rule_id` attribute set via the Sentinel Standardization processor. |

1. *`basic` delivers logs to a single custom log table. `asim` routes records to native Microsoft Sentinel ASIM tables via the `sentinel_stream_name` attribute set per record by the `asim_standardization` processor.*

#### Advanced

| Parameter            | Type   | Default                              | Description                                                                                                                                                             |
| -------------------- | ------ | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Fallback Stream Name | String | `Custom-ASimAuthenticationEventLogs` | Fallback stream used only for records that bypass the `asim_standardization` processor.<sup>1</sup> Applies when `mode` is `asim`.                                      |
| Raw Log Field        | String | `""`                                 | The field name used to send raw logs to the Log Analytics workspace. When set, logs are sent as `{ "RawData": ... }` and the custom table must have a `RawData` column. |

1. *Targets records without a `sentinel_stream_name` attribute; records that carry the attribute route per record and ignore this value.*

#### Retry on Failure

| Parameter               | Type    | Default | Description                                                                                                                                   |
| ----------------------- | ------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable Retry on Failure | Boolean | `true`  | Attempt to resend telemetry data that has failed to be transmitted to the destination.                                                        |
| Initial interval        | Integer | `5`     | Time (in seconds) to wait after the first failure before retrying. Applies when retry is enabled.                                             |
| Max interval            | Integer | `30`    | The upper bound (in seconds) on backoff. Applies when retry is enabled.                                                                       |
| Max elapsed time        | Integer | `300`   | The maximum amount of time (in seconds) spent trying to send a batch, used to avoid a never-ending retry loop. Applies when retry is enabled. |

#### Sending Queue

| Parameter                 | Type      | Default      | Description                                                                                                                                                           |
| ------------------------- | --------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable Sending Queue      | Boolean   | `true`       | Buffer telemetry data temporarily before sending to help ensure data is not lost during a temporary network outage.                                                   |
| Number of Consumers       | Integer   | `10`         | Number of consumers that dequeue batches. Applies when the sending queue is enabled.                                                                                  |
| Queue Size                | Integer   | `5000`       | Maximum number of batches kept in memory before dropping. Applies when the sending queue is enabled.                                                                  |
| Enable Persistent Queuing | Boolean   | `true`       | Buffer telemetry data to disk before sending to help ensure data is not lost during network outages or collector restarts. Applies when the sending queue is enabled. |
| Persistent Queue Storage  | Extension | file storage | The storage to use for the persistent queue. Applies when the sending queue and persistent queue are enabled.                                                         |

### Example Configuration

#### Standalone Destination

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  id: microsoftsentinel
  name: microsoftsentinel
spec:
  type: microsoftsentinel
  parameters:
    - name: mode
      value: 'basic'
    - name: endpoint
      value: '<your-log-ingestion-endpoint>'
    - name: client_id
      value: '<your-client-id>'
    - name: client_secret
      value: '<your-client-secret>'
    - name: tenant_id
      value: '<your-tenant-id>'
    - name: rule_id
      value: '<your-dcr-immutable-id>'
    - name: stream_name_basic
      value: 'Custom-my_logs'
```

### Configuration Tips

#### Choosing a mode

* Use **Basic** for a single flat custom table you provision yourself, with full control over the schema. Set `stream_name_basic` to the `Custom-`-prefixed table name.
* Use **ASIM** to land records in native Sentinel ASIM tables so analytics rules, workbooks, and hunting queries work against the standard schema. ASIM mode requires the `asim_standardization` processor on the pipeline, which sets the `sentinel_stream_name` attribute used for per-record routing.

#### Raw log mode (Basic)

* Leave `raw_log_field` empty to send logs in OTLP JSON format. The custom table must match that schema.
* Set `raw_log_field` (for example, `body`) to send logs as `{ "RawData": ... }`. The custom table must have a `RawData` column.

#### Per-record overrides (ASIM)

* `rule_id` and the stream name can be overridden per record by the `sentinel_rule_id` and `sentinel_stream_name` attributes set by the standardization processor. `stream_name_asim` is only the fallback for records that arrive without a `sentinel_stream_name` attribute.

### Troubleshooting

**Symptom:** Logs are accepted by the collector but never appear in Microsoft Sentinel. **Solution:** The first export to a new table can take 5 to 15 minutes to surface. If logs still do not appear, confirm the service principal holds the **Monitoring Metrics Publisher** role on the DCR and that `endpoint`, `rule_id`, and the stream name match the DCR and target table exactly.

**Symptom:** Authentication fails or the exporter reports a 401/403 error. **Solution:** Verify `client_id`, `client_secret`, and `tenant_id` belong to the Entra application registration, and that the client secret has not expired. Recreate the secret in Azure if needed and update the destination.

**Symptom:** No DCR endpoint URL is shown in Azure. **Solution:** Update the API version in the JSON view of the DCR ruleset. If the endpoint is still missing, provision a Data Collection Endpoint (DCE) and use its ingestion endpoint. See the [Logs Ingestion API documentation](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview#data-collection-rule-dcr).

### Related Resources

* [Microsoft Sentinel overview](https://learn.microsoft.com/en-us/azure/sentinel/overview)
* [Logs Ingestion API in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview)
* [Data Collection Rule structure](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-structure)
* [Data Collection Endpoint overview](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-endpoint-overview?tabs=portal)
* [Register an Entra application](https://learn.microsoft.com/en-us/azure/healthcare-apis/register-application)
* [Advanced Security Information Model (ASIM)](https://learn.microsoft.com/en-us/azure/sentinel/normalization)
* [Persistent Queue configuration](https://docs.bindplane.com/configuration/bindplane-otel-collector/persistent-queue)

```
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/integrations/destinations/microsoft-sentinel.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.