Microsoft Sentinel

Learn how to send events to Azure Monitor to use with Microsoft Sentinel from Couchdrop

Overview

Send Couchdrop events to Azure Monitor Logs for use with Microsoft Sentinel. Couchdrop uses Azure’s Data Collection Rule (DCR) ingestion method.

Configure Azure Monitor Logs

Before you start

To configure Azure Monitor for Couchdrop, you will need:

• An Azure account with permission to create or manage Log Analytics, Data Collection Rules, Data Collection Endpoints, and Microsoft Entra App Registrations.

1

Create the logging destination

In Azure, create or select a Log Analytics Workspace.

Then configure Azure Monitor Logs to receive Couchdrop events:

1. Create a Data Collection Endpoint (DCE) in the same region as the workspace.
2. Copy its Logs Ingestion Endpoint URL.
3. Create a Custom log (DCR-based) table using the Couchdrop JSON schema.
4. Create a Data Collection Rule (DCR) connected to the endpoint, workspace, and custom log table.

From the DCR, copy:

• Immutable ID
• Stream Name

The stream name will typically look like:

Custom-CouchdropLogs_CL

Copy it exactly, including the Custom- prefix.

2

Create credentials for Couchdrop

In Microsoft Entra ID, create an App Registration for Couchdrop.

Copy:

• Application (client) ID
• Directory (tenant) ID

Create a client secret and copy its Value.

Finally, open the Data Collection Rule's Access Control (IAM) settings and give the App Registration the Monitoring Metrics Publisher role.

For more information about DCR-based log ingestion, see Microsoft's Logs Ingestion API documentation.

3

Check that you have all six values

Before moving to Couchdrop, you should now have:

• Tenant ID
• Client ID
• Client Secret
• Log Ingestion Endpoint
• DCR Immutable ID
• Stream Name

You will paste these values into Couchdrop in the next section.

Set up Microsoft Sentinel in Couchdrop

Before you start

To configure Microsoft Sentinel logging in Couchdrop, you will need:

• A Couchdrop account with access to the SIEM logging settings.
• The six values from configuring Azure Monitor Logs.

1

Open Microsoft Sentinel logging settings

Log in to Couchdrop and navigate to Admin Panel → Logging.

Find the Microsoft Sentinel provider and select Connect or Manage.

2

Select events to send

Select the Couchdrop events that you want to send to Azure Monitor Logs.

3

Enter your Azure configuration

Enter the Azure values collected during the previous steps:

• Tenant ID
• Client ID
• Client Secret
• Log Ingestion Endpoint
• DCR Immutable ID
• Stream Name

4

Save the configuration

Click Save Updates to save the Microsoft Sentinel logging configuration.

Troubleshooting

If events are not appearing in Azure Monitor Logs, check the following:

• The Log Analytics Workspace, DCE, and DCR use the same Azure region.
• The stream name includes the Custom- prefix and matches the DCR exactly.
• The App Registration has the Monitoring Metrics Publisher role on the DCR.
• The client secret Value, rather than the secret ID, was entered in Couchdrop.