Skip to content
MDView as Markdown

Microsoft Sentinel

Sentinel's own ingestion API authenticates with a bearer token from an app registration, which our webhook cannot send. A Logic App bridges the gap: its HTTP trigger is authenticated by a signature in the URL, so we can post to it with no header at all, and the Logic App performs the authenticated write into your workspace.

That makes Sentinel reachable without hosting anything yourself - the bridge is a first-party Azure resource you configure in the portal.

How it fits together

Report URI  ──POST──▶  Logic App HTTP trigger  ──authenticated──▶  Log Analytics workspace
            (URL only)                          (managed identity)

Creating the trigger URL

  1. Create a Logic App (Consumption) in the same region as your Log Analytics workspace.
  2. Add the When an HTTP request is received trigger.
  3. Save the workflow. Azure generates the callback URL only after the first save.
  4. Copy the URL from the trigger.

It looks like:

https://<host>/workflows/<id>/triggers/When_a_HTTP_request_is_received/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2F...%2Frun&sv=1.0&sig=<signature>

The sig parameter is a SHA256 signature generated from a secret key held by the Logic App. Microsoft's guidance is explicit that anyone holding a URI with a valid key can invoke the trigger - so treat the whole URL as a credential.

Writing the events into your workspace

Add an action after the trigger that writes to Log Analytics. Custom data goes into a custom table (_CL suffix) via a data collection rule, and the DCR can transform the incoming JSON to match the table schema, so you do not have to reshape our payload before it arrives.

The Azure side of this changes more often than our side does - see Microsoft's Logs Ingestion API overview for the current action, the DCR template and the required role assignment.

Sending the audit trail to it

Paste the trigger URL into the Audit Trail webhook field - Account Settings for a personal account, or the Teams page for a team. See Audit Trail for what the feed contains.

You can point Watch alerts at the same trigger from any watcher's Config modal, though most teams route those to chat and keep Sentinel for the audit feed.

Things to watch for

  • Save the workflow before copying the URL. The callback URL does not exist until the first save, and the field is empty before then.
  • Our payload is a single JSON object; the Logs Ingestion API expects an array. Wrap it in the Logic App rather than trying to change the shape at our end.
  • The signature is tied to the trigger name. Renaming the trigger invalidates the URL and alerts stop.
  • Regenerating the Logic App's access keys invalidates the URL too. Update the webhook field when you rotate.
  • The URL appears in your Report URI audit trail, since we record the target of every delivery attempt. Anyone with access to your audit trail can therefore invoke your Logic App.

Official documentation

Microsoft - Secure access and data in Azure Logic Apps

Start Monitoring with Report URI

Already using us? Create the Logic App, then paste its trigger URL into the Audit Trail webhook field.

New to Report URI? The Audit Trail webhook is available on Business and Enterprise plans.

Start your free trial