Microsoft Sentinel

The Microsoft Sentinel destination exports logs from Bindplane to Microsoft Sentinel (Azure Log Analytics) using the Logs Ingestion API. Logs are delivered through a Data Collection Rule (DCR) to either a single custom table (Basic mode) or to native Sentinel ASIM tables routed per record (ASIM mode).

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• A Microsoft Entra (Azure AD) application registration with a client ID, client secret, and tenant ID.
• A Log Analytics workspace and a Data Collection Rule (DCR). You need the DCR ingestion endpoint and the DCR rule ID (immutable ID).
• The service principal must hold the Monitoring Metrics Publisher role on the DCR.
• Basic mode: a custom log table in the workspace, prefixed with Custom-.
• ASIM mode: the companion asim_standardization processor on the pipeline. It sets the sentinel_stream_name attribute Bindplane uses to route each record to its ASIM table.

Configuration

Logs

Parameter	Type	Default	Description
Mode	Enum	basic	Delivery mode. Required.1
Endpoint	String		Required. The DCR/DCE log ingestion endpoint.
Client ID	String		Required. The client ID used for authentication with Azure.
Client Secret	String		Required. The client secret used for authenticating with Azure. Sensitive value.
Tenant ID	String		Required. The tenant ID used for authenticating with Azure.
Stream Name	String		Required when mode is basic. Name of the custom log table in the Log Analytics workspace. Must be prefixed with Custom-.
Rule ID	String		Required. The Data Collection Rule (DCR) ID or immutable ID. Can be overridden per record by the sentinel_rule_id attribute set via the Sentinel Standardization processor.

1. basic delivers logs to a single custom log table. asim routes records to native Microsoft Sentinel ASIM tables via the sentinel_stream_name attribute set per record by the asim_standardization processor.

Advanced

Parameter	Type	Default	Description
Fallback Stream Name	String	Custom-ASimAuthenticationEventLogs	Fallback stream used only for records that bypass the asim_standardization processor.1 Applies when mode is asim.
Raw Log Field	String	""	The field name used to send raw logs to the Log Analytics workspace. When set, logs are sent as { "RawData": ... } and the custom table must have a RawData column.

1. Targets records without a sentinel_stream_name attribute; records that carry the attribute route per record and ignore this value.

Retry on Failure

Parameter	Type	Default	Description
Enable Retry on Failure	Boolean	true	Attempt to resend telemetry data that has failed to be transmitted to the destination.
Initial interval	Integer	5	Time (in seconds) to wait after the first failure before retrying. Applies when retry is enabled.
Max interval	Integer	30	The upper bound (in seconds) on backoff. Applies when retry is enabled.
Max elapsed time	Integer	300	The maximum amount of time (in seconds) spent trying to send a batch, used to avoid a never-ending retry loop. Applies when retry is enabled.

Sending Queue

Parameter	Type	Default	Description
Enable Sending Queue	Boolean	true	Buffer telemetry data temporarily before sending to help ensure data is not lost during a temporary network outage.
Number of Consumers	Integer	10	Number of consumers that dequeue batches. Applies when the sending queue is enabled.
Queue Size	Integer	5000	Maximum number of batches kept in memory before dropping. Applies when the sending queue is enabled.
Enable Persistent Queuing	Boolean	true	Buffer telemetry data to disk before sending to help ensure data is not lost during network outages or collector restarts. Applies when the sending queue is enabled.
Persistent Queue Storage	Extension	file storage	The storage to use for the persistent queue. Applies when the sending queue and persistent queue are enabled.

Example Configuration

Standalone Destination

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  id: microsoftsentinel
  name: microsoftsentinel
spec:
  type: microsoftsentinel
  parameters:
    - name: mode
      value: 'basic'
    - name: endpoint
      value: '<your-log-ingestion-endpoint>'
    - name: client_id
      value: '<your-client-id>'
    - name: client_secret
      value: '<your-client-secret>'
    - name: tenant_id
      value: '<your-tenant-id>'
    - name: rule_id
      value: '<your-dcr-immutable-id>'
    - name: stream_name_basic
      value: 'Custom-my_logs'

Configuration Tips

Choosing a mode

• Use Basic for a single flat custom table you provision yourself, with full control over the schema. Set stream_name_basic to the Custom--prefixed table name.
• Use ASIM to land records in native Sentinel ASIM tables so analytics rules, workbooks, and hunting queries work against the standard schema. ASIM mode requires the asim_standardization processor on the pipeline, which sets the sentinel_stream_name attribute used for per-record routing.

Raw log mode (Basic)

• Leave raw_log_field empty to send logs in OTLP JSON format. The custom table must match that schema.
• Set raw_log_field (for example, body) to send logs as { "RawData": ... }. The custom table must have a RawData column.

Per-record overrides (ASIM)

• rule_id and the stream name can be overridden per record by the sentinel_rule_id and sentinel_stream_name attributes set by the standardization processor. stream_name_asim is only the fallback for records that arrive without a sentinel_stream_name attribute.

Troubleshooting

Symptom: Logs are accepted by the collector but never appear in Microsoft Sentinel. Solution: The first export to a new table can take 5 to 15 minutes to surface. If logs still do not appear, confirm the service principal holds the Monitoring Metrics Publisher role on the DCR and that endpoint, rule_id, and the stream name match the DCR and target table exactly.

Symptom: Authentication fails or the exporter reports a 401/403 error. Solution: Verify client_id, client_secret, and tenant_id belong to the Entra application registration, and that the client secret has not expired. Recreate the secret in Azure if needed and update the destination.

Symptom: No DCR endpoint URL is shown in Azure. Solution: Update the API version in the JSON view of the DCR ruleset. If the endpoint is still missing, provision a Data Collection Endpoint (DCE) and use its ingestion endpoint. See the Logs Ingestion API documentation.

Related Resources

• Microsoft Sentinel overview
• Logs Ingestion API in Azure Monitor
• Data Collection Rule structure
• Data Collection Endpoint overview
• Register an Entra application
• Advanced Security Information Model (ASIM)
• Persistent Queue configuration