Microsoft Sentinel

Works with: Microsoft Sentinel and any Azure Monitor Log Analytics workspace (Azure public cloud). SafeHanded uses the Logs Ingestion API. The older HTTP Data Collector API was retired in September 2026.

Status: verified

Tested end to end against a live Log Analytics workspace (UK South), deployed from this page’s template: the test event and the audit log arrived in SafeHanded_Audit_CL, and the hourly credential check passed.

You’ll create three things in Azure: a table for the events, a data collection rule that accepts them, and an app registration that SafeHanded signs in as. A template does the first two.

1. Create the table and rule (template)

1. Download the template: sentinel-safehanded.json.
2. In the Azure portal: Deploy a custom template → Build your own template in the editor → Load file, choose the file, Save.
3. Pick the resource group of your Log Analytics workspace, enter the workspace name, and keep the region the same as the workspace’s. Review + create.
4. When it finishes, copy the rule’s logs ingestion endpoint and immutable ID. The easiest place: search the portal for Data collection rules → safehanded-audit. The Immutable Id (dcr-…) is in the Essentials box on its Overview; for the endpoint, click JSON View, set the API version to 2023-03-11 or later and copy endpoints.logsIngestion (it looks like https://safehanded-audit-abcd-uksouth.logs.z1.ingest.monitor.azure.com). The same two values are the deployment’s Outputs (resource group → Deployments → the deployment → Outputs).

The template creates the table SafeHanded_Audit_CL (90 days’ retention by default) and a data collection rule safehanded-audit with its own ingestion endpoint and the stream Custom-SafeHanded_Audit_CL.

2. Create the app registration

1. Microsoft Entra admin centre → App registrations → New registration, name it SafeHanded audit stream, single tenant, no redirect URI.
2. Copy the Application (client) ID and Directory (tenant) ID.
3. Certificates & secrets → New client secret, and copy its Value.
4. In the Azure portal open the data collection rule safehanded-audit → Access control (IAM) → Add role assignment → Monitoring Metrics Publisher, and assign it to the app. Only this role, only on this rule.

Role assignments can take up to 30 minutes to apply.

3. Connect in SafeHanded

Settings → Integrations → Connect → Microsoft Sentinel: enter the tenant ID, client ID, client secret, the logs ingestion endpoint and the data collection rule immutable ID (starts dcr-). Leave Stream name blank. Save, then Send test event.

4. Query

SafeHanded_Audit_CL
| where TimeGenerated > ago(1d)
| project TimeGenerated, Event, ActorLabel, RequestId, SourceIp, Seq
| order by Seq asc

Columns: TimeGenerated, OrgId, Seq, PrevHash, Hash, Sig, SigKeyId, Event, Level, ActorType, ActorId, ActorLabel, RequestId, ShareId, ClientId, ClientSeq (long, client streams only), SourceIp, UserAgent, Metadata (dynamic). The format is always SafeHanded JSON: the table has fixed columns, so OCSF isn’t offered.

The first data into the new table takes 5 to 15 minutes to appear (sometimes up to 30). Rows keep the time each event happened in SafeHanded, so set the Logs Time range wide enough (e.g. last 30 days) when your history is older than a day. To confirm Azure took the data, open the rule’s Monitoring → Metrics and add Logs Rows Received per Min and Logs Rows Dropped per Min.

Troubleshooting

• Microsoft Entra refused the app credentials (AADSTS…): wrong tenant, client ID or secret, or the secret has expired.
• Rejected the credentials (HTTP 403): the app doesn’t have Monitoring Metrics Publisher on the rule yet, or the assignment hasn’t applied. Wait up to 30 minutes.
• Not found (HTTP 404): the endpoint, rule ID or stream name doesn’t match the rule.
• Data takes a few minutes to appear in the table the first time.