Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,268 questions
How to post log data to sentinel from a custom application
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 73%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAG%3C/text%3E%3C/svg%3E)
Andy Gibson
0
Reputation points
Hi!
I am working on a multi-tenanted cloud application. Some customers will wish certain log entries to be passed to Microsoft Sentinel. Most competitor products (Elastic, Splunk, ...) seem to offer an HTTP API which may be used, ie we can just perform an HTTP POST request to a specific URL with some kind of authentication. Is this also possible with Sentinel, please? I have not been able to find any details about this yet.
Many thanks,
Andy
Microsoft Sentinel
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 38%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMP%3C/text%3E%3C/svg%3E)
Marcin Policht 44,850 Reputation points MVP2025-04-06T20:47:32.46+00:00 Follow https://learn.microsoft.com/en-us/azure/sentinel/data-transformation
Microsoft Sentinel uses the following Azure Monitor tools to control custom data ingestion:
- Transformations are defined in DCRs and apply KQL queries to incoming data before it's stored in your workspace. These transformations can filter out irrelevant data, enrich existing data with analytics or external data, or mask sensitive or personal information.
- The Logs ingestion API allows you to send custom-format logs from any data source to your Log Analytics workspace, and store those logs either in certain standard tables, or in custom-formatted tables that you create. You have full control over the creation of these custom tables, down to specifying the column names and types. The API uses DCRs to define, configure, and apply transformations to these data flows.
Details are included in the article referenced above and the corresponding MS Learn documentation
hth
Marcin
-
Clive Watson 7,636 Reputation points MVP2025-04-26T07:29:31.3033333+00:00 if you need to build this as a connector please look here: https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector
Sign in to comment
Sign in to answer