Microsoft Sentinel
Configure Microsoft Sentinel SIEM integration with RAD Security to import alerts and events for unified threat analysis.
This guide walks you through creating an Entra ID application, granting it read access to your Microsoft Sentinel workspace, and gathering the values required to connect Microsoft Sentinel as a SIEM with RAD Security.
Microsoft Sentinel is a cloud-native SIEM built on Azure Monitor and Log Analytics. RAD Security connects to your Sentinel workspace to pull security alerts and events for unified, offline threat analysis alongside your runtime, cloud, and Kubernetes telemetry.
This integration is read-only. RAD Security queries alerts and events from Microsoft Sentinel — it does not write data into your workspace. No Data Collection Rule or ingestion endpoint is required.
Prerequisites
Before you begin, ensure you have:
- A Microsoft Sentinel workspace enabled on a Log Analytics workspace
- Admin access to Microsoft Entra ID to create an application and grant a client secret
- Permission to assign Azure roles (Owner or User Access Administrator) on the subscription or resource group that contains the workspace
- Access to a RAD Security workspace with integration permissions
Alert retrieval requires the Defender portal. To read Sentinel alerts, your workspace must be connected to the Microsoft Defender portal. Event queries over Log Analytics tables work without this connection.
Understanding Integration Components
The Microsoft Sentinel integration authenticates with an Entra ID application using OAuth client credentials and reads from your Log Analytics workspace:
Step 1: Create an Entra ID Application
Create the application and service principal
Follow the Microsoft guide to create a Microsoft Entra application and service principal.
Choose a descriptive name (e.g., "RAD Security Sentinel"). Because this is a service-to-service integration, no redirect URI or user sign-in is required.
Note the application credentials
On the application's Overview tab, copy the following values to a secure location:
- Application (client) ID
- Directory (tenant) ID
Step 2: Create a Client Secret
Navigate to Certificates & secrets
In your Entra ID application, go to Manage → Certificates & secrets.
Create a new client secret
Follow the Microsoft guide to add a new client secret.
- Click New client secret
- Add a description (e.g., "RAD Security Integration Key")
- Select an expiration period
- Click Add
Copy the secret value
Immediately copy the secret value to a secure location alongside your Client ID and Tenant ID.
This is your only chance to view the secret! Once you navigate away from this page, the value cannot be retrieved again. If you lose it, create a new secret.
Step 3: Grant Access to the Sentinel Workspace
Open your Log Analytics workspace
In the Azure portal, navigate to the Log Analytics workspace that backs your Microsoft Sentinel instance.
Open Access control (IAM)
Select Access control (IAM) → Add → Add role assignment.
Assign Microsoft Sentinel Reader
Follow the Microsoft guide to assign an Azure role. Assign the Microsoft Sentinel Reader role to the Entra ID application (service principal) created in Step 1.
Assigning at the workspace scope is the most restrictive option. You may assign at the resource group or subscription scope if you plan to connect multiple workspaces.
Add Log Analytics Reader for event queries
Repeat the role assignment to also grant Log Analytics Reader to the same application. This allows RAD Security to run KQL queries against your Log Analytics tables when syncing events.
These roles together cover the access RAD Security needs: Microsoft.OperationalInsights/workspaces/read and read access to Microsoft.SecurityInsights/*.
Step 4: Gather your Workspace Values
Open the workspace Overview
In the Azure portal, open your Log Analytics workspace and select the Overview tab.
Copy the workspace identifiers
Record the following values to a secure location:
- Subscription ID — the Azure subscription that contains the workspace
- Resource group — the resource group that contains the workspace
- Workspace ID — the Log Analytics workspace ID (a GUID, shown on the Overview page)
- Workspace Name — the name of the workspace
Step 5: Configure in RAD Security
Navigate to your RAD Security workspace and configure the Microsoft Sentinel integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Client ID | The Application (client) ID from Step 1 | 11111111-1111-1111-1111-111111111111 |
| Client Secret | The client secret value from Step 2 | your-secret-value-here |
| Tenant ID | The Directory (tenant) ID from Step 1 | 00000000-0000-0000-0000-000000000000 |
| Subscription ID | The subscription containing the workspace (Step 4) | 22222222-2222-2222-2222-222222222222 |
| Resource Group | The resource group containing the workspace (Step 4) | rg-security |
| Workspace ID | The Log Analytics workspace ID (Step 4) | 33333333-3333-3333-3333-333333333333 |
| Workspace Name | The Log Analytics workspace name (Step 4) | sentinel-workspace |
Optional Parameters
| Parameter | Description | Example |
|---|---|---|
| Default Tables | Comma-separated list of Log Analytics tables to query for events. Recommended on workspaces with many tables — see the warning below before leaving this blank. | SecurityAlert, SecurityIncident |
| Logs URL | Azure Monitor Logs API base URL — only for alternate clouds such as GovCloud | https://api.loganalytics.azure.us |
| Management URL | Azure Management API base URL — only for alternate clouds such as GovCloud | https://management.usgovcloudapi.net |
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources → Integrations → SIEM in RAD Security
- Locate your Microsoft Sentinel integration
- Check the connection status shows as Connected
- Confirm alerts and events begin appearing as the first sync completes
Your Microsoft Sentinel integration is now configured! RAD Security will pull alerts and events from your Sentinel workspace for unified threat analysis.
What Data is Synced
Use Cases
Unified Threat Analysis Correlate Microsoft Sentinel alerts and events with RAD Security's runtime insights for comprehensive detection.
Offline Investigation Analyze synced Sentinel data within RAD Security without round-tripping to the Azure portal.
Cross-Platform Detection Detect threats that span Azure, endpoints, and containerized infrastructure using unified data sources.
AI-Assisted Triage Let RADBot query Sentinel alerts and events to accelerate investigation and triage.
Troubleshooting
Security Best Practices
Least Privilege Access Assign only Microsoft Sentinel Reader and Log Analytics Reader — this integration never writes to your workspace.
Scope the Role Assignment Assign roles at the workspace scope rather than the subscription unless you connect multiple workspaces.
Rotate Secrets Regularly Set short expiration periods for client secrets and rotate them before expiry. Create the new secret before deleting the old one.
Secure Secret Storage Store the client secret in a secrets vault. Never commit it to version control.
Dedicated Application Use an Entra ID application dedicated to RAD Security rather than sharing one across integrations.
Monitor Application Activity Review the service principal's sign-in and Azure activity logs to detect anomalous behavior.
Additional Resources
Onboard Microsoft Sentinel
Official Microsoft documentation for enabling Microsoft Sentinel
Create an Entra Application
Microsoft documentation for creating an application and service principal
Assign Azure Roles
Microsoft documentation for assigning Azure RBAC roles
ASIM Schemas
Microsoft documentation for the Advanced Security Information Model