Overview

The Azure Sentinel integration uses the Microsoft Sentinel REST API to read:

• Incidents and their lifecycle changes
• Analytics rule alerts and entity mappings
• Bookmarks and investigation comments
• Watchlist updates

This is useful when Sentinel acts as a primary detection engine and you want to correlate its incidents alongside other Atatus telemetry.

Prerequisites

• A Microsoft Sentinel-enabled Log Analytics workspace.
• An Azure AD app registration with permission to read Sentinel data (Microsoft Sentinel Reader role on the resource group or workspace).

Step 1: Register an app in Azure AD

1. In the Azure portal, open Microsoft Entra ID → App registrations → New registration.
2. Name it atatus-sentinel-reader and click Register.
3. Copy the Application (client) ID and Directory (tenant) ID from the Overview page.
4. Open Certificates & secrets → New client secret, copy the secret Value.

Step 2: Grant Sentinel access

1. Open the Resource group that contains the Sentinel workspace (or the workspace itself).
2. Go to Access control (IAM) → Add role assignment.
3. Choose the role Microsoft Sentinel Reader, then assign it to the app you registered.

Step 3: Connect Azure Sentinel in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Azure Sentinel card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The Azure Sentinel card shows Configured.
• Sentinel incidents and alerts appear in Security → Cloud SIEM → Audit Logs → Events with source azure_sentinel.