Microsoft Sentinel Notifications
Anzenna forwards detection notifications into your Microsoft Sentinel workspace as records in a custom table. When a detection finds new events, Anzenna writes a record you can query, alert on, and correlate with the rest of your Sentinel data.
Setup
1. Connect Microsoft Sentinel
Before you can forward notifications, connect your workspace to Anzenna. Follow the
Connect Microsoft Sentinel
integration guide to create the custom table and app registration.
2. Enable Microsoft Sentinel on a Detection
Open a detection and go to its Notification Settings.
Toggle Microsoft Sentinel on.
Select your connected Microsoft Sentinel workspace.
Click Save.
A record is written when the detection's stats are next recalculated — not the moment you save the configuration — so it can take a short time to appear in Sentinel.
What Gets Sent
Each notification is one record in the AnzennaDetections_CL table
with these fields:
| Field | Description |
|---|---|
TimeGenerated | When the notification fired |
DetectionId | Stable Anzenna detection identifier |
Title | Detection name |
Body | Human-readable summary |
IncidentCount | New events in this notification |
PreviousCount | Events seen in the prior notification |
UserCount | Number of affected users |
EventCount | Total events on the detection |
AffectedUsers | Array of affected user identifiers |
ActionUrl | Direct link to the detection in Anzenna |
Query the most recent detections in your workspace:
AnzennaDetections_CL
| sort by TimeGenerated desc
| take 20
Per-Source Overrides
You can enable or disable Microsoft Sentinel notifications for individual detections using
per-source overrides
. This lets you forward only the detections that warrant it.