About the Microsoft Sentinel Integration
Microsoft Sentinel is Microsoft’s cloud-native SIEM and SOAR platform, providing intelligent security analytics, threat detection, automated incident response, and security orchestration across enterprise environments at cloud scale. Part of Synqly’s SIEM Unified API, the Microsoft Sentinel integration enables security teams to route normalized security event data from Synqly-connected tools into Sentinel’s analytics and detection engine through a standardized connector. Integrate with Microsoft Sentinel to centralize security telemetry from across your security stack into Microsoft’s platform, enabling AI-powered threat detection, investigation, and automated response.
Integration Use Cases
Get Alert
Retrieves an alert by ID.
Get Investigation
Retrieves an investigation by ID.
Patch Investigation
Updates an investigation by ID.
Post Events
Writes a batch of `Event` objects to the SIEM configured with the token used for authentication.
Query Alerts
Queries alerts from the SIEM configured with the token used for authentication.
Query Events
Queries events from the SIEM configured with the token used for authentication.
Query Investigations
Queries investigations
Query Log Providers
Queries available log providers in the source SIEM
