Microsoft Sentinel Integration

Integration Guide: Connecting Microsoft Sentinel with HiperAI This guide describes the necessary steps to configure Microsoft Sentinel to receive security logs from SecureAI via Azure Data Collection Rules (DCR).

Step 1: Create the Application Identity (App Registration)

First, we’ll create an identity for your application in Azure, allowing it to authenticate securely.

A. Go to Azure Active Directory

In the Azure portal, search for and select Azure Active Directory.

B. New Registration

On the left menu, navigate to App registrations and click + New registration.

C. Name the Application

Provide a clear name, such as SecureAI-Log-Ingester and leave the other options as their defaults. Click Register.

D. Copy the IDs

From the new application’s Overview page, copy and securely store the following values:

Application (client) ID
Directory (tenant) ID

E. Create the Client Secret

On the left menu, go to Certificates & secrets and click + New client secret. Provide a description (e.g., “SentinelLogKey”) and click Add.

CRITICAL STEP: Immediately copy the secret’s Value. This is the only time it will be fully visible. Store it securely with the other IDs.

Step 2: Create the Azure Ingestion Infrastructure

Now, we will build the “pathway” and “storage” for your logs.

A. Create the Data Collection Endpoint (DCE)

1. Find the Service

In the Azure search bar, search for and select Data Collection Endpoints.

2. Create a New DCE

Click + Create.

3. Configure the DCE

Name: dce-secureai-integration
Region: Choose the same region as your Log Analytics Workspace
Click Review + create, and then Create

4. Copy the URI

Once deployed, navigate to the resource. On its Overview page, copy the Logs ingestion URI and save it.

B. Create the Custom Table and Data Collection Rule (DCR)

1. Go to Log Analytics

Navigate to your Log Analytics Workspace.

2. Create a Custom Table

On the left menu, click Tables, then + Create, and select New custom log (DCR-based).

3. “Basics” Tab

Table name: secureaitosiem (Azure will automatically append _CL, making the full name secureaitosiem_CL)
Data collection rule: Select “Create a new…” and name it dcr-secureai-events

Data collection endpoint: Select the DCE you created earlier (dce-secureai-integration)
Click Next: Schema and transformation

4. “Schema and transformation” Tab

Upload a sample file: The system will prompt you. Create a .json file with the following content and upload it:

[
  {
    "time": "2025-08-30T21:34:29.013Z",
    "level": "Info",
    "message": "SecureAI platform started successfully",
    "component": "SystemService",
    "correlationId": "test-001"
  },
  {
    "time": "2025-08-30T21:34:30.013Z",
    "level": "Warning",
    "message": "High memory usage detected on server",
    "component": "MonitoringService",
    "correlationId": "test-002"
  },
  {
    "time": "2025-08-30T21:34:31.013Z",
    "level": "Error",
    "message": "Database connection timeout after 30 seconds",
    "component": "DatabaseService",
    "correlationId": "test-003"
  },
  {
    "time": "2025-08-30T21:34:32.013Z",
    "level": "Info",
    "message": "User admin@secureai.com logged in successfully",
    "component": "AuthService",
    "correlationId": "test-004"
  },
  {
    "time": "2025-08-30T21:34:33.013Z",
    "level": "Warning",
    "message": "API rate limit approaching threshold",
    "component": "APIGateway",
    "correlationId": "test-005"
  },
  {
    "time": "2025-08-30T21:34:34.013Z",
    "level": "Info",
    "message": "Security scan completed - 0 threats found",
    "component": "SecurityScanner",
    "correlationId": "test-006"
  },
  {
    "time": "2025-08-30T21:34:35.013Z",
    "level": "Error",
    "message": "Failed to sync with external SIEM system",
    "component": "SIEMSync",
    "correlationId": "test-007"
  },
  {
    "time": "2025-08-30T21:34:36.013Z",
    "level": "Info",
    "message": "Backup job completed successfully",
    "component": "BackupService",
    "correlationId": "test-008"
  }
]

Download Sample File: You can also download the complete sample JSON file to use directly: 📥 sample.json

5. Apply the Transformation

The system may show a warning about the TimeGenerated field. Click the Transformation editor button, delete all existing content, and paste the following complete KQL query:

source
| extend TimeGenerated = todatetime(['time'])
| project
    TimeGenerated,
    Level_s = tostring(['level']),
    Message_s = tostring(['message']),
    Component_s = tostring(['component']),
    CorrelationId_s = tostring(['correlationId'])

Click Apply. You should see a preview of the table with all the correct columns and data types.

6. Finalize Creation

Click Next: Review + create and then Create.

Step 3: Connect the Identity to the Infrastructure (Permissions)

This crucial step grants our application permission to use the data collection rule we just created.

A. Go to your new DCR

Search for and open your Data Collection Rule, dcr-secureai-events and in “Overview”, copy the immutable ID and save it for integration.

B. Assign the Role

On the left menu, go to Access control (IAM) and click + Add → Add role assignment.

Role: Search for and select Monitoring Metrics Publisher.

Select Monitoring Metrics Publisher Role

Members: Click Select members and search for your App Registration name (SecureAI-Log-Ingester). Select it.

Click Review + assign. You’re almost done. Just one final step.

A. Gather the Information

To complete the integration, the application needs the following six pieces of information:

Tenant ID: (From Step 1)
Client ID: (From Step 1)
Client Secret: (From Step 1)
DCE URI: (From Step 2A)
DCR Immutable ID: (Navigate to your DCR dcr-secureai-events and copy this from the JSON View)
Stream Name: This is a constructed value. The format is Custom-{TableName}. In our case, it will be: Custom-secureaitosiem_CL

B. Configure the Application

Input these 6 values into your application’s configuration settings.

Step 5: Verify the Integration

Once you have entered the integration details into the SecureAI application, you can verify that the connection is working correctly.

A. Test the Connection

Use the “Test Connection” button within our application. This will send a test event to your Microsoft Sentinel workspace.

B. Find the Test Event in Log Analytics

To see if the event arrived in Microsoft Sentinel, go to your Log Analytics Workspace and click on Logs. Run the following query to see your incoming data:

secureaitosiem_CL
| order by TimeGenerated desc

You should see your log data appearing with all columns (TimeGenerated, Level_s, Message_s, etc.) correctly populated. If so, your integration is a success! ✅

Note: Depending on network traffic and system load, it can sometimes take up to 10 minutes for logs to appear in Microsoft Sentinel.

Done!

With these steps, your Microsoft Sentinel instance is fully configured to integrate with SecureAI 😎.

Getting Started

Security, SMLTP & DLP

AI Gateway

Identity & Access (SSO)

AI Discovery (Shadow AI)

Endpoint Agent

Integrations: Cloud AI & IDEs

Integrations: Files (Drive & SharePoint)

Integrations: SIEMs, Network & MCP

Microsoft Sentinel Integration

Microsoft Sentinel Integration

Step 1: Create the Application Identity (App Registration)

A. Go to Azure Active Directory

B. New Registration

C. Name the Application

D. Copy the IDs

E. Create the Client Secret

Step 2: Create the Azure Ingestion Infrastructure

A. Create the Data Collection Endpoint (DCE)

1. Find the Service

2. Create a New DCE

3. Configure the DCE

4. Copy the URI

B. Create the Custom Table and Data Collection Rule (DCR)

1. Go to Log Analytics

2. Create a Custom Table

3. “Basics” Tab

4. “Schema and transformation” Tab

5. Apply the Transformation

6. Finalize Creation

Step 3: Connect the Identity to the Infrastructure (Permissions)

A. Go to your new DCR

B. Assign the Role

A. Gather the Information

B. Configure the Application

Step 5: Verify the Integration

A. Test the Connection

B. Find the Test Event in Log Analytics

Done!

​Microsoft Sentinel Integration

​Step 1: Create the Application Identity (App Registration)

​A. Go to Azure Active Directory

​B. New Registration

​C. Name the Application

​D. Copy the IDs

​E. Create the Client Secret

​Step 2: Create the Azure Ingestion Infrastructure

​A. Create the Data Collection Endpoint (DCE)

​1. Find the Service

​2. Create a New DCE

​3. Configure the DCE

​4. Copy the URI

​B. Create the Custom Table and Data Collection Rule (DCR)

​1. Go to Log Analytics

​2. Create a Custom Table

​3. “Basics” Tab

​4. “Schema and transformation” Tab

​5. Apply the Transformation

​6. Finalize Creation

​Step 3: Connect the Identity to the Infrastructure (Permissions)

​A. Go to your new DCR

​B. Assign the Role

​Step 4: Finalize and Share Information

​A. Gather the Information

​B. Configure the Application

​Step 5: Verify the Integration

​A. Test the Connection

​B. Find the Test Event in Log Analytics

​Done!

Microsoft Sentinel Integration

Step 1: Create the Application Identity (App Registration)

A. Go to Azure Active Directory

B. New Registration

C. Name the Application

D. Copy the IDs

E. Create the Client Secret

Step 2: Create the Azure Ingestion Infrastructure

A. Create the Data Collection Endpoint (DCE)

1. Find the Service

2. Create a New DCE

3. Configure the DCE

4. Copy the URI

B. Create the Custom Table and Data Collection Rule (DCR)

1. Go to Log Analytics

2. Create a Custom Table

3. “Basics” Tab

4. “Schema and transformation” Tab

5. Apply the Transformation

6. Finalize Creation

Step 3: Connect the Identity to the Infrastructure (Permissions)

A. Go to your new DCR

B. Assign the Role

Step 4: Finalize and Share Information

A. Gather the Information

B. Configure the Application

Step 5: Verify the Integration

A. Test the Connection

B. Find the Test Event in Log Analytics

Done!