Cribl

Destination

Microsoft Sentinel

Collect and analyze security and threat data across the enterprise

Microsoft Sentinel is a scalable, cloud-native, SIEM (security information event management) and SOAR (security orchestration automated response) platform. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.

How to get data flowing

This integration is facilitated through the Cribl Stream Azure Monitor Logs Destination.

  • Enable Microsoft Sentinel’s integration with Azure Monitor Logs, ensuring appropriate permissions on the subscription that owns the Microsoft Sentinel workspace.

  • Configure Stream to send data to Azure Event Hubs via Destinations > Azure Monitor Logs.

  • Specify the Azure Log Analytics Workspace ID, Workspace Key, Log Type, backpressure behavior, and optional parameters.

  • Stream will start sending data as it becomes available.

View Documentation

Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy. Customers use Cribl’s suite of products to collect, process, route, and analyze all IT and security data, delivering the flexibility, choice, and control required to adapt to their ever-changing needs.

We offer free training, certifications, and a free tier across our products. Our community Slack features Cribl engineers, partners, and customers who can answer your questions as you get started and continue to build and evolve. We also offer a variety of hands-on-Sandboxes for those interested in how companies globally leverage our products for their data challenges.