{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["img","admonition"]},"type":"markdown"},"seo":{"title":"Integrating Coro with Microsoft Sentinel","description":"Coro's support and product documentation portal","siteUrl":"https://docs.coro.net","keywords":"Coro docs portal, documentation, support, docs","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"integrating-coro-with-microsoft-sentinel","__idx":0},"children":["Integrating Coro with Microsoft Sentinel"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this guide to integrate Coro with Microsoft Sentinel (",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-sentinel"},"children":["www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-sentinel"]},") for collection of ticket data related to an event."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro connects to Microsoft Sentinel through the Logs Ingestion API. This uses Microsoft Entra ID OAuth-based authentication and utilizes DCEs (Data Collection Endpoints) and DCRs (Data Collection Rules) to filter, transform, and map incoming connections."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":1},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide assumes you have access to the Microsoft Azure portal with admin permissions."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you start this procedure, make sure you have a previously-configured ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["Log Analytics workspace"]}," in Microsoft Azure. For further information, see the Azure portal documentation."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"information-for-existing-sentinel-users","__idx":2},"children":["Information for existing Sentinel users"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you have an existing Sentinel integration in Coro, be aware that Microsoft retired the previous ingestion method (from September 2026). To continue using Sentinel with Coro, you must recreate the connector using the new method described in this guide."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro displays a warning banner where it identifies an existing connector using the previous method:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-legacy.178a2805e0aaf68f12d31064d1d57ab7b203ab5a0ecbe8d2a2a1a6c06a4922ec.dd802eb3.png","alt":"A warning banner showing that existing Sentinel connectors need migrating","withLightbox":true,"width":"800px"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro does not disable Existing Sentinel connectors, but you can no longer edit the settings. Coro advises recreating the connector at the earliest opportunity to avoid service disruption."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"summary-of-steps","__idx":3},"children":["Summary of steps"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To configure Coro's Sentinel connector, you need to:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a Data Collection Endpoint (DCE)"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a Data Collection Rule (DCR) and custom log table."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Register Coro as an approved application for sending logs."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Configure the Sentinel connector in Coro."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Coro connector configuration relies on several identifiers gathered during the previous steps in the Microsoft Azure portal. This guide advises when to keep a note of the required data items."]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"creating-a-dce-in-azure","__idx":4},"children":["Creating a DCE in Azure"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To create a DCE:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sign in to the Microsoft Azure portal (",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://portal.azure.com"},"children":["portal.azure.com"]},") with adminstrative permissions."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the search bar at the top to search for \"DCE\". Azure should recommend \"Data collection endpoints\" within the \"Services\" category. Select this link."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection endpoints"]}," page:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dce.516324ba1e460dd57a9168ddf7954acab965671a0795bfca76c01464118363d9.dd802eb3.png","alt":"Azure Data collection endpoints page","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Create"]}," to create a new DCE."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create data collection endpoint"]}," dialog:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dce-create.ea3371bedb18085f2ddc5779c615ddb9b25d3e1d7cd1fa260435a0b980f2eb14.dd802eb3.png","alt":"Create a Data collection endpoint","withLightbox":true,"width":"500px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter the following details:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Endpoint name"]},": Enter a name for the endpoint."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Subscription"]},": Select your Azure subscription."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resource group"]},": Select the resource group used in your Log Analytics workspace."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Region"]},": Select the region used in your Log Analytics workspace."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Skip the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tags"]}," page and proceed to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review + create"]}," to create your new DCE."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure creates the DCE and shows it on the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection endpoints"]}," page:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dce-populated.025368386de467693399113be1cbd7c89cdffac18f9c79e2c9b7aa7e051e16f3.dd802eb3.png","alt":"Azure Data collection endpoints page","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select your new DCE and make a note of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Logs Ingestion"]}," URL for later:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dce-logsingestion.31cdc29c67647525190555c3f6b6725e777a60e512511f8a3eae55f958958ada.dd802eb3.png","alt":"DCE logs ingestion identifier","withLightbox":true},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"creating-a-dcr-and-custom-log-table-in-azure","__idx":5},"children":["Creating a DCR and custom log table in Azure"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To create a DCR and custom log table:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sign in to the Microsoft Azure portal (",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://portal.azure.com"},"children":["portal.azure.com"]},") with adminstrative permissions."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the search bar at the top to search for and select your Logs Analytics workspace."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings > Tables"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the workspace ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tables"]}," list:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-workspace-tables.28e633527b91d087072134fd82cc31d64141c04b1f138369fb0025a1e7fd22b8.dd802eb3.png","alt":"Logs Analytics workspace Tables list","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Create"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create a custom log"]}," page:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-workspace-tables-create.b774d27ae910e5b6cd876a9d3d7359ab41a0905dba8820c46a44184c433406f5.dd802eb3.png","alt":"Create a custom log table","withLightbox":true,"width":"500px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Table name"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection rule"]},", select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create a new data collection rule"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create a new data collection rule"]}," pane:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-workspace-tables-create-dcr.9b41827c37fa8ef40060de8720f1a7e16c0ae11ca3ea32f06f46775384d05ea3.dd802eb3.png","alt":"Create a new DCR","withLightbox":true,"width":"500px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the new DCR, select the same Azure subscription and resource group you used when creating your Logs Analytics workspace (and specified when creating your ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#creating-a-dce-in-azure"},"children":["DCE"]},")."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Name"]}," for your new DCR. Make a note of this for later."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Done"]}," to create the DCR and automatically add it to the custom log table ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection rule"]}," setting."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection endpoint"]},", select your ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#creating-a-dce-in-azure"},"children":["DCE"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Next"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Schema and transformation"]}," step:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-workspace-tables-create-schema.48c8d876c74fa16c0e8aa3fe679662a1752e62eaed86a3da21a735901e14fb86.dd802eb3.png","alt":"","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Download this ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/Coro-Sentinel-schema.json"},"children":["sample schema"]}," and upload to Azure."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Next"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review"]}," step, make a note of the full table name for later."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create"]},"."]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After you have created the DCR and custom log table, make a note of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Immutable ID"]},":"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the search bar at the top to search for \"DCR\". Azure should recommend \"Data collection rules\" within the \"Services\" category. Select this link."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection rules"]}," page:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr.b5a35ce726e2d71df0054d06a8d0e8c2625068b3fd61fff9e83d12d0572c61d6.dd802eb3.png","alt":"Azure Data collection rules page","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection rules"]}," tab:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr-rules.38cb7e13243c7f81ffe9e4618b2bf8f725327091bbf5714570f645ffff941d40.dd802eb3.png","alt":"Data collection rules tab","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Locate and select the DCR you created earlier."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Make a note of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Immutable ID"]}," for later:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr-rules-immid.815550e5f51e4045c05e6730beb592e615231c0be73560a6ab565c82879760d7.dd802eb3.png","alt":"Noting the DCR Immutable ID","withLightbox":true},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"register-coro-as-an-approved-app-in-azure","__idx":6},"children":["Register Coro as an approved app in Azure"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To register Coro as an approved app, use Microsoft Entra ID:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sign in to the Microsoft Azure portal (",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://portal.azure.com"},"children":["portal.azure.com"]},") with adminstrative permissions."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the search bar at the top to search for \"Entra ID\". Azure should recommend \"Microsoft Entra ID\" within the \"Services\" category. Select this link."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Overview"]}," page, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add > App registration"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-entraid.3c7a3e66f4a12fca5e32d7a6bec8d28e01d718b6cd2252b36811b58c23332515.dd802eb3.png","alt":"Adding a new App registration in Entra ID","withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register an application"]}," dialog:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-entraid-register.bf62f81b75a00480d1a5d466b9a6598351eb9d84e80c168f0e98a2fbe6a3c6e6.dd802eb3.png","alt":"Register an application dialog in Entra ID","withLightbox":true,"width":"600px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Name"]}," for your app."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select the account you want to use with this app."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After creating the app, Azure displays the app overview:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-entraid-overview.b7a740b5f9bb86c93289c7ffce985c16de3ce595d28d855c97893ebb0a2ce0c3.dd802eb3.png","alt":"App overview in Entra ID","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Make a note of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application (client) ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Directory (tenant) ID"]}," for later."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Locate ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client credentials"]}," and select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add a certificate or secret"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-entraid-overview-clientcreds.e719b97ca08ba09ea2bc9ae6d6fce0946e04eef638d7a0b8674546a356d44685.dd802eb3.png","alt":"Client credentials field in the app overview","withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Certificates & secrets"]}," page, on the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client secrets"]}," tab:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-entraid-overview-clientcreds-secrets.5a409c1dcfc4d3dbd2a19092abaf2781daae1ea93c81ba0b0772737e6f244230.dd802eb3.png","alt":"Client certificates and secrets page","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ New client secret"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add a client secret"]}," dialog:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-entraid-overview-clientcreds-secrets-add.a295b3950d8e8f08d484552c8e0a243e9ad8d71e9064c4d2b3faea63dc4e2085.dd802eb3.png","alt":"Add a new client secret dialog","withLightbox":true,"width":"400px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Description"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Expires"]}," period that meets your requirements."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure adds the new secret to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client secrets"]}," list."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Value"]}," field for later:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-entraid-overview-clientcreds-secrets-value.1b0ae31f240f8f4e840fcb256407ea0eee30b3c34c1392e5618b9ab1572e8720.dd802eb3.png","alt":"Copy the new client secret value","withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You must complete this step now as the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Value"]}," may not be visible after you navigate away from this page. If you need to see the value later, remove the old secret and add a new one."]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After you have registered the new app, grant the app access control permission to send logs:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the search bar at the top to search for \"DCR\". Azure should recommend \"Data collection rules\" within the \"Services\" category. Select this link."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection rules"]}," page:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr.b5a35ce726e2d71df0054d06a8d0e8c2625068b3fd61fff9e83d12d0572c61d6.dd802eb3.png","alt":"Azure Data collection rules page","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data collection rules"]}," tab:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr-rules.38cb7e13243c7f81ffe9e4618b2bf8f725327091bbf5714570f645ffff941d40.dd802eb3.png","alt":"Data collection rules tab","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Locate and select the DCR you created earlier."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access control (IAM)"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr-iam.af291be06396fedfe9bf84be0fda0771a40e1e1fdd757d15e41d087d9f465efb.dd802eb3.png","alt":"Access control (IAM) link","withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access control (IAM)"]}," page."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"id":"add-iam-role"},"children":[]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add > Add role assignment"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr-iam-add.9a511b6252101948ca25ba3b0f68ca49a80220e2b3adbf392290cd70e29e0133.dd802eb3.png","alt":"Add new role assignment","withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add role assignment"]}," page."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["From the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Role"]}," tab, use the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Job function roles"]}," search bar to locate the role \"Monitoring Metrics Publisher\":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr-iam-add-function.adf6da39a3acdc796da8615951883d1ba229c39cfd101ad4d5fe2fb158309d78.dd802eb3.png","alt":"Add new job function role","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select this role, then select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Next"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Members"]}," tab:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr-iam-add-members.1ea22ef5f5873bfb4f2065bb152eeeb83ee72ead938760429ad8f7348da5bcf6.dd802eb3.png","alt":"Add role assignment members tab","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Assign access to"]},", select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User, group, or service principal"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Select members"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Select members"]}," dialog."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Search for and select the app you registered earlier:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-dcr-iam-add-members-select.bf3c7037e435b3508073b0af1279e8be70c08a65cc0361a74c429b95cbff08da.dd802eb3.png","alt":"Select the app as a member","withLightbox":true,"width":"400px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Select"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Next"]}," to continue to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review + assign"]}," tab."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review + assign"]},"."]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Next, configure your Resource Group with the same access control permissions:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the search bar at the top to search for \"resource group\". Azure should recommend \"Resource groups\" within the \"Services\" category. Select this link."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select your resource group."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the resource group overview, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access control (IAM)"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-sentinel-rg.e2833c7f764e9f6b1a2ecaf67370c1a146d6a326912ecc1b35e509d5508646c7.dd802eb3.png","alt":"Select Access Control (IAM) in your resource group","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Repeat the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#add-iam-role"},"children":["previous procedure"]}," to add the same role assignment here as already completed for your DCR."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configuring-a-microsoft-sentinel-connector-in-coro","__idx":7},"children":["Configuring a Microsoft Sentinel connector in Coro"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you start this procedure, make sure you followed the steps in all previous sections of this guide."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To configure a Microsoft Sentinel connector in Coro:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/overview/log-in"},"children":["Sign in to the Coro console"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["From the sidebar, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Control Panel"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workspace"]},", select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connectors"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/control-panel-connectors.ab41a5d9d3f0ae20478980f5a9f2c3653fd655b06443719e582eb3595d0c44ad.dd802eb3.png","alt":"Connectors","withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connectors"]}," page."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SIEM"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors-page.6aea1944597a5cbd37790445ec617189c55f4555928346f13398eea86f750017.dd802eb3.png","alt":"The Connectors page","withLightbox":true},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ADD CONNECTOR"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add connector"]}," dialog:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/add_connector_dialog-sentinel.7397fb2f2d6165e7f40fa785dd3c8ab88ee3bea9d83751b1d443f1a28879bc45.dd802eb3.png","alt":"The MS Sentinel Add connector dialog","withLightbox":true,"width":"400px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Configure the following connection settings:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Name"]},": Enter a suitable connector name."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Format"]},": Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Azure Sentinel"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tenant ID"]},": The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Directory (tenant) ID"]}," field from your registered app. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#register-coro-as-an-approved-app-in-azure"},"children":["Register Coro as an approved app in Azure"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]},": The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application (tenant) ID"]}," field from your registered app. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#register-coro-as-an-approved-app-in-azure"},"children":["Register Coro as an approved app in Azure"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},": The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Value"]}," field from the client secret. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#register-coro-as-an-approved-app-in-azure"},"children":["Register Coro as an approved app in Azure"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["DCE Endpoint"]},": The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Logs Ingestion"]}," identifer from your DCE. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#creating-a-dce-in-azure"},"children":["Creating a DCE in Azure"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["DCR Immutable ID"]},": The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Immutable ID"]}," field from your DCR. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#creating-a-dcr-and-custom-log-table-in-azure"},"children":["Creating a DCR and custom log table in Azure"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Stream name"]},": The custom log table name you created, prefixed with \"Custom-\". See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"#creating-a-dcr-and-custom-log-table-in-azure"},"children":["Creating a DCR and custom log table in Azure"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For example, if your table name is \"Sentinel_CL\" (\"_CL\" is added automatically by Azure to indicate a ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["custom"]}," table), your full stream name is \"Custom-Sentinel_CL\"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you are familiar with the Azure CLI, you can optionally execute the following command to see the stream name:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"az monitor data-collection rule list -g %RESOURCE_GROUP_NAME% -o json  \n\\  --query \"[?immutableId=='%DCR_IMMUTABLE_ID%'].{name:name, dataFlowStreams:dataFlows[].streams, declaredStreams:keys(streamDeclarations)}\" ) \n"},"children":[]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Apply to all customers"]},": (MSP admin users only) Enable this option to automatically create the connector in all descendant workspaces linked to the channel workspace. Each descendant workspace then forwards events to the configured SIEM provider."]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ADD"]},"."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connectors_apply_to_all.9046a5213ef4873202d31e1b054d432835a3eeda3ededd9b01e77af1367c6d8c.dd802eb3.png","alt":"Add MS Sentinel connector","withLightbox":true,"width":"600px"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro sends a test event to verify your configuration. If the configuration is incorrect, Coro displays an error dialog. Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["GOT IT"]}," to return to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connectors"]}," page. Coro does not save the configuration:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connector-error-generic.3a5ebeec01928944ea2977163ac4cc1860cb89164e1cf6ec4ec3748d272a7b49.dd802eb3.png","alt":"Invalid connector configuration","withLightbox":true,"width":"350px"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the configuration is correct, Coro creates the connector with a status of ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connected"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/connector-connected2.099602dcb4c01d4ad32edf58925df8ffbe31a7ea5ed6feceb89058cfe8be053e.dd802eb3.png","alt":"Successful MS Sentinel connector configuration","withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For MSP channel workspaces, Coro adds the connector to the channel workspace and, if ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Apply to all customers"]}," is enabled, to all connected descendant workspaces."]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro sends event data and metadata to the configured SIEM in real time. If the SIEM is unavailable, Coro cannot collect or send event data."]}]},"headings":[{"value":"Integrating Coro with Microsoft Sentinel","id":"integrating-coro-with-microsoft-sentinel","depth":1},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Information for existing Sentinel users","id":"information-for-existing-sentinel-users","depth":2},{"value":"Summary of steps","id":"summary-of-steps","depth":2},{"value":"Creating a DCE in Azure","id":"creating-a-dce-in-azure","depth":2},{"value":"Creating a DCR and custom log table in Azure","id":"creating-a-dcr-and-custom-log-table-in-azure","depth":2},{"value":"Register Coro as an approved app in Azure","id":"register-coro-as-an-approved-app-in-azure","depth":2},{"value":"Configuring a Microsoft Sentinel connector in Coro","id":"configuring-a-microsoft-sentinel-connector-in-coro","depth":2}],"frontmatter":{"seo":{"title":"Integrating Coro with Microsoft Sentinel"}},"lastModified":"2026-09-01T12:03:15.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/admin/siem-sentinel","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}