> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/integrations/siem/microsoft-sentinel.md).

# Microsoft Sentinel

Learn how to send events to Azure Monitor to use with Microsoft Sentinel from Couchdrop

## Overview

Send Couchdrop events to Azure Monitor Logs for use with Microsoft Sentinel. Couchdrop uses Azure’s Data Collection Rule (DCR) ingestion method.

## Configure Azure Monitor Logs

{% hint style="warning" %}

### Before you start

To configure Azure Monitor for Couchdrop, you will need:

* An Azure account with permission to create or manage Log Analytics, Data Collection Rules, Data Collection Endpoints, and Microsoft Entra App Registrations.
  {% endhint %}

{% stepper %}
{% step %}

### Create the logging destination

In Azure, create or select a **Log Analytics Workspace**.

Then configure Azure Monitor Logs to receive Couchdrop events:

1. Create a **Data Collection Endpoint (DCE)** in the same region as the workspace.
2. Copy its **Logs Ingestion Endpoint URL**.
3. Create a **Custom log (DCR-based)** table using the [Couchdrop JSON schema](https://docs.couchdrop.io/administration/logging).
4. Create a **Data Collection Rule (DCR)** connected to the endpoint, workspace, and custom log table.

From the DCR, copy:

* **Immutable ID**
* **Stream Name**

The stream name will typically look like:

```
Custom-CouchdropLogs_CL
```

Copy it exactly, including the `Custom-` prefix.
{% endstep %}

{% step %}

### Create credentials for Couchdrop

In Microsoft Entra ID, create an **App Registration** for Couchdrop.

Copy:

* **Application (client) ID**
* **Directory (tenant) ID**

Create a client secret and copy its **Value**.

Finally, open the Data Collection Rule's **Access Control (IAM)** settings and give the App Registration the **Monitoring Metrics Publisher** role.

{% hint style="info" %}
For more information about DCR-based log ingestion, see Microsoft's [Logs Ingestion API documentation](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview).
{% endhint %}
{% endstep %}

{% step %}

### Check that you have all six values

Before moving to Couchdrop, you should now have:

* Tenant ID
* Client ID
* Client Secret
* Log Ingestion Endpoint
* DCR Immutable ID
* Stream Name

You will paste these values into Couchdrop in the next section.
{% endstep %}
{% endstepper %}

## Set up Microsoft Sentinel in Couchdrop

{% hint style="warning" %}

### Before you start

To configure Microsoft Sentinel logging in Couchdrop, you will need:

* A Couchdrop account with access to the SIEM logging settings.
* The six values from [configuring Azure Monitor Logs](#configure-azure-monitor-logs).
  {% endhint %}

{% stepper %}
{% step %}

### Open Microsoft Sentinel logging settings

Log in to Couchdrop and navigate to **Admin Panel → Logging**.

Find the Microsoft Sentinel provider and select **Connect** or **Manage**.
{% endstep %}

{% step %}

### Select events to send

Select the Couchdrop events that you want to send to Azure Monitor Logs.
{% endstep %}

{% step %}

### Enter your Azure configuration

Enter the Azure values collected during the previous steps:

* **Tenant ID**
* **Client ID**
* **Client Secret**
* **Log Ingestion Endpoint**
* **DCR Immutable ID**
* **Stream Name**
  {% endstep %}

{% step %}

### Save the configuration

Click **Save Updates** to save the Microsoft Sentinel logging configuration.
{% endstep %}
{% endstepper %}

## Troubleshooting

If events are not appearing in Azure Monitor Logs, check the following:

* The Log Analytics Workspace, DCE, and DCR use the same Azure region.
* The stream name includes the `Custom-` prefix and matches the DCR exactly.
* The App Registration has the **Monitoring Metrics Publisher** role on the DCR.
* The client secret **Value**, rather than the secret ID, was entered in Couchdrop.