Microsoft Sentinel
Leak events are written into your Sentinel workspace as a custom table.
How it works
The connection runs over a data collection endpoint and a data collection rule. Authentication uses an Entra ID app registration; the application is given the publisher role on the rule and nothing else.
Delivery is one-way. No query is run in Sentinel and no table is read.
Acceptance means the record was received. When it appears in the table depends on Sentinel’s ingestion cycle and can take a few minutes.
Fields delivered
| Field | Content |
|---|---|
TimeGenerated | When the event was written |
kind | Event type |
eventId | Event identifier |
title | Event title |
summary | One-sentence summary |
severity | critical · high · medium · low · info |
link | The event’s address in the panel |
The rule’s stream declaration must carry these names exactly. kind and title are reserved words in Azure and have to be escaped with square brackets in the transform query.
The leaked value itself is not sent.
Limits
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.