Chapter 20. Integrating with Microsoft Sentinel notifier

Procedure

1. In the RHACS portal, click Platform Configuration Integrations.
2. Scroll down to the Notifier Integrations section, and then click Microsoft Sentinel.
3. To create a new integration, click New integration.

4. In the Create integration page, provide the following information:

   • Integration name: Specify a name for the integration.

   • Log ingestion endpoint: Enter the data collection endpoint. You can find the endpoint in the Microsoft Azure portal.

     For more information, see Data collection rules (DCRs) in Azure Monitor (Microsoft Azure documentation).

   • Directory tenant ID: Enter your unique tenant ID within the Microsoft Azure cloud infrastructure. You can find the tenant ID in the Microsoft Azure portal.

     For more information, see Find tenant name and tenant ID in Azure Active Directory B2C (Microsoft Azure documentation).

   • Application client ID: Enter the client ID which uniquely identifies the specific application registered within your AAD that needs access to resources. You can find the client ID in the Microsoft Entra portal for the service principal you have created.

     For more information, see Register applications (Microsoft Azure documentation).

   • Choose the appropriate authentication method:

     • If you want to use a secret, enter the secret value. You can find the secret in the Microsoft Azure portal.
     • If you want to use a client certificate, enter the client certificate and private key. You can find the certificate ID and private key in the Microsoft Azure portal.

     • If you want to use an Azure managed identity, select the Use workload identity checkbox.

       For more information, see The new App registrations experience for Azure Active Directory B2C (Microsoft Azure documentation).

   • Optional: Choose the appropriate method to configure the data collection rule configuration:

     • Select the Enable alert DCR checkbox, if you want to enable the alert data collection rule configuration.

       To create an alert data collection rule, enter the alert data collection rule stream name and ID. You can find the stream name and ID in the Microsoft Azure portal.

     • Select the Enable audit log DCR checkbox, if you want to enable audit data collection rule configuration.

       To create an audit data collection rule, enter the stream name and ID. You can find the stream name and ID in the Microsoft Azure portal.

       For more information, see Data collection rules (DCRs) in Azure Monitor (Microsoft Azure documentation).

5. Optional: To test the new integration, click Test.
6. To save the new integration, click Save.

Verification

1. In the RHACS portal, click Platform Configuration Integrations.
2. Scroll down to the Notifier Integrations section, and then click Microsoft Sentinel.
3. In the Integrations Microsoft Sentinel page, verify that the new integration has been created.
4. Verify that the messages receive the correct log tables in your log analytics workspace.