> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/integrations/siem/microsoft-sentinel.md).

# Microsoft Sentinel

Learn how to send events to Azure Monitor to use with Microsoft Sentinel from Couchdrop

## Overview

Send Couchdrop events to Azure Monitor Logs for use with Microsoft Sentinel. Couchdrop uses Azure’s Data Collection Rule (DCR) ingestion method.

## Configure Azure Monitor Logs

{% hint style="warning" %}

### Before you start

To configure Azure Monitor for Couchdrop, you will need:

* An Azure account with permission to create or manage Log Analytics, Data Collection Rules, Data Collection Endpoints, and Microsoft Entra App Registrations.
  {% endhint %}

{% stepper %}
{% step %}

### Create the logging destination

In Azure, create or select a **Log Analytics Workspace**.

Then configure Azure Monitor Logs to receive Couchdrop events:

1. Create a **Data Collection Endpoint (DCE)** in the same region as the workspace.
2. Copy its **Logs Ingestion Endpoint URL**.
3. Create a **Custom log (DCR-based)** table using the [Couchdrop JSON schema](https://docs.couchdrop.io/administration/logging).
4. Create a **Data Collection Rule (DCR)** connected to the endpoint, workspace, and custom log table.

From the DCR, copy:

* **Immutable ID**
* **Stream Name**

The stream name will typically look like:

```
Custom-CouchdropLogs_CL
```

Copy it exactly, including the `Custom-` prefix.
{% endstep %}

{% step %}

### Create credentials for Couchdrop

In Microsoft Entra ID, create an **App Registration** for Couchdrop.

Copy:

* **Application (client) ID**
* **Directory (tenant) ID**

Create a client secret and copy its **Value**.

Finally, open the Data Collection Rule's **Access Control (IAM)** settings and give the App Registration the **Monitoring Metrics Publisher** role.

{% hint style="info" %}
For more information about DCR-based log ingestion, see Microsoft's [Logs Ingestion API documentation](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview).
{% endhint %}
{% endstep %}

{% step %}

### Check that you have all six values

Before moving to Couchdrop, you should now have:

* Tenant ID
* Client ID
* Client Secret
* Log Ingestion Endpoint
* DCR Immutable ID
* Stream Name

You will paste these values into Couchdrop in the next section.
{% endstep %}
{% endstepper %}

## Set up Microsoft Sentinel in Couchdrop

{% hint style="warning" %}

### Before you start

To configure Microsoft Sentinel logging in Couchdrop, you will need:

* A Couchdrop account with access to the SIEM logging settings.
* The six values from [configuring Azure Monitor Logs](#configure-azure-monitor-logs).
  {% endhint %}

{% stepper %}
{% step %}

### Open Microsoft Sentinel logging settings

Log in to Couchdrop and navigate to **Admin Panel → Logging**.

Find the Microsoft Sentinel provider and select **Connect** or **Manage**.
{% endstep %}

{% step %}

### Select events to send

Select the Couchdrop events that you want to send to Azure Monitor Logs.
{% endstep %}

{% step %}

### Enter your Azure configuration

Enter the Azure values collected during the previous steps:

* **Tenant ID**
* **Client ID**
* **Client Secret**
* **Log Ingestion Endpoint**
* **DCR Immutable ID**
* **Stream Name**
  {% endstep %}

{% step %}

### Save the configuration

Click **Save Updates** to save the Microsoft Sentinel logging configuration.
{% endstep %}
{% endstepper %}

## Troubleshooting

If events are not appearing in Azure Monitor Logs, check the following:

* The Log Analytics Workspace, DCE, and DCR use the same Azure region.
* The stream name includes the `Custom-` prefix and matches the DCR exactly.
* The App Registration has the **Monitoring Metrics Publisher** role on the DCR.
* The client secret **Value**, rather than the secret ID, was entered in Couchdrop.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.couchdrop.io/integrations/siem/microsoft-sentinel.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.