Connect Microsoft Sentinel to Anzenna

Anzenna pushes detection notifications into your Microsoft Sentinel workspace using the Azure Monitor Logs Ingestion API. Detections land in a custom table you create, where you can query them, build analytics rules, and correlate them with the rest of your Sentinel data.

This is a one-way push: Anzenna authenticates as an app registration you create and can only write to a single data collection rule. It never reads from your workspace.

note

These steps apply to the Azure commercial cloud. Government and sovereign clouds are not supported today.

Prerequisites

• A Log Analytics workspace with Microsoft Sentinel enabled.

• Permission to create a Data Collection Endpoint, a Data Collection Rule, and a custom table in that workspace.

• Permission to register an application in Microsoft Entra ID and assign it a role.

• Administrator access to the Anzenna platform.

---

Step-by-Step Instructions

Part 1: Create the custom table

Anzenna sends a fixed set of fields. Create a DCR-based custom table whose schema matches them exactly — a mismatch causes Azure to silently reject the records.

1. In the Azure portal, open your Log Analytics workspace and go to Settings > Tables.

2. Click Create > New custom log (DCR-based).

3. Name the table AnzennaDetections_CL. Custom table names must end in _CL.

4. Create a new Data Collection Rule and a new Data Collection Endpoint when prompted — the wizard creates both for you, and you collect their values in Part 2. Put both in the same region as your workspace.

5. When asked for a sample, upload the JSON below. Azure infers the table columns from it.

[
  {
    "TimeGenerated": "2026-01-01T00:00:00Z",
    "DetectionId": "det-000000000000001",
    "Title": "Example detection",
    "Body": "Human-readable summary of the detection.",
    "IncidentCount": 3,
    "PreviousCount": 1,
    "UserCount": 2,
    "EventCount": 5,
    "AffectedUsers": ["user1@example.com", "user2@example.com"],
    "ActionUrl": "https://app.anzenna.ai/detections/det-000000000000001"
  }
]

The resulting table has these columns:

Column	Type	Notes
TimeGenerated	datetime	Required by Azure
DetectionId	string	Stable Anzenna detection identifier
Title	string	Detection name
Body	string	Summary; may be empty
IncidentCount	long	New events in this notification
PreviousCount	long	Events seen previously
UserCount	long	Affected users
EventCount	long	Total events
AffectedUsers	dynamic	Array of user identifiers
ActionUrl	string	Deep link back to Anzenna

Part 2: Note your endpoint, rule, and stream

From the resources you just created, record three values — each comes from a different place, and you will assemble them into one URL in Part 5:

• The Logs ingestion URI from the Data Collection Endpoint (looks like https://<name>-<hash>.<region>.ingest.monitor.azure.com).

• The rule's Immutable ID (on the DCR's JSON View or Overview, looks like dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx).

• The stream name for the table (the wizard names it Custom-AnzennaDetections_CL). Confirm the exact value on the DCR's JSON View under dataFlows.

Part 3: Register an Entra application

1. In Microsoft Entra ID, go to App registrations > New registration. Name it (for example, "Anzenna Sentinel Push") and register it.

2. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID.

3. Go to Certificates & secrets > New client secret. Copy the secret value immediately — Azure shows it only once.

Part 4: Grant the app permission to the rule

1. Open the Data Collection Rule > Access control (IAM) > Add role assignment.

2. Assign the Monitoring Metrics Publisher role to your app registration. This is the only permission Anzenna needs.

tip

Role assignments can take up to 30 minutes to propagate. If the first test push returns a permission error, wait and retry before changing anything.

Part 5: Assemble the Logs Ingestion URL

Combine the three values from Part 2 into a single URL:

https://<logs-ingestion-host>/dataCollectionRules/<immutable-id>/streams/<stream-name>?api-version=2023-01-01

For example:

https://anzenna-1a2b.westus.ingest.monitor.azure.com/dataCollectionRules/dcr-00000000000000000000000000000000/streams/Custom-AnzennaDetections_CL?api-version=2023-01-01

Part 6: Connect in Anzenna

1. In Anzenna, go to Settings > Integrations and select Microsoft Sentinel.

2. Enter the four values you collected:

   • Tenant ID — the Directory (tenant) ID from Part 3.

   • Logs Ingestion URL — the full URL from Part 5.

   • Client ID — the Application (client) ID from Part 3.

   • Client Secret — the secret value from Part 3.

3. Click Connect.

Once connected, enable Microsoft Sentinel on the detections you want to forward — see

Microsoft Sentinel Notifications

.

---

Verify

After a detection forwards, run this query in your workspace to confirm the records arrive (data can take a few minutes to appear):

AnzennaDetections_CL
| take 10

---

Troubleshooting

Symptom	Likely cause
Permission / 403 error	The Monitoring Metrics Publisher role is missing or has not propagated yet
404 error	Wrong immutable ID or stream name in the URL
Records never appear	Stream schema does not match the columns in Part 1
"URL must be https" or "not an Azure ingestion host"	The URL scheme or host is wrong; the host must end in .ingest.monitor.azure.com

---

Need help? Contact

Anzenna Support

for assistance.