Microsoft Sentinel

The Microsoft Sentinel sink delivers Alphyn events to a Log Analytics workspace through the Azure Monitor Logs Ingestion API, routed through a Data Collection Endpoint (DCE) and a Data Collection Rule (DCR) into a custom table. Once the events land, they are available to Sentinel analytics rules, hunting queries, and workbooks like any other Sentinel data source.

Configure it in the Alphyn dashboard under Integrations, using integration key sentinel.

Configuration

Field	Required	Description
aad_tenant_id	Yes	The Microsoft Entra ID (Azure AD) tenant ID that owns the app registration.
client_id	Yes	Application (client) ID of the app registration Alphyn authenticates as.
client_secret	Yes	Client secret for that app registration.
dce_endpoint	Yes	The Data Collection Endpoint logs-ingestion URI.
dcr_immutable_id	Yes	Immutable ID of the Data Collection Rule that routes the stream.
stream_name	Yes	The custom stream declared in the DCR, for example Custom-AlphynSecurity_CL.
aad_authority_base	No	Azure AD authority base for sovereign clouds, for example the Azure Government authority.
scope	No	Token scope for sovereign clouds, matching the sovereign Monitor resource.

Note

For sovereign clouds such as Azure Government, set aad_authority_base and scope to the sovereign endpoints. For public Azure, leave both empty and Alphyn uses the public-cloud defaults.

Ingested record format

Alphyn sends a JSON array of records to the Logs Ingestion API. Each record carries a TimeGenerated column plus the canonical Alphyn fields, mapped by the DCR into your custom table:

[
  {
    "TimeGenerated": "2026-07-16T09:41:21.880Z",
    "TenantId": "acme",
    "EventFamily": "THREAT",
    "EventType": "ROOT-V1",
    "Module": "ROOT",
    "Name": "Root detected",
    "Severity": "CRITICAL",
    "Description": "Root management binary present",
    "DeviceId": "dev_5521",
    "Package": "com.acme.banking",
    "AppVersion": "4.8.1",
    "AppHash": "9ad1f0c4",
    "Os": "Android 14",
    "SourceIp": "203.0.113.24"
  }
]

Setup on the Azure side

1. Create (or reuse) a Microsoft Entra ID app registration and a client secret. Note its aad_tenant_id and client_id.
2. Create a Data Collection Endpoint in the same region as your Log Analytics workspace and note its logs-ingestion URI for dce_endpoint.
3. Create a custom table in the workspace (for example AlphynSecurity_CL) and a Data Collection Rule that declares the custom stream and routes it to that table. Note the DCR immutableId for dcr_immutable_id and the stream name for stream_name.
4. Grant the app registration the Monitoring Metrics Publisher role on the DCR so it can post records.
5. In the Alphyn dashboard, add a Microsoft Sentinel integration, enter the Entra ID, DCE, and DCR fields, add sovereign-cloud fields if applicable, and set the delivery filter.
6. Click Test connection to deliver a synthetic event, then confirm the row appears in your custom table in Log Analytics.

Example queries

Events by severity over the last day:

AlphynSecurity_CL
| where TimeGenerated > ago(1d)
| summarize count() by Severity, bin(TimeGenerated, 1h)
| render timechart

Top event types:

AlphynSecurity_CL
| where TimeGenerated > ago(7d)
| summarize count() by EventType
| top 10 by count_

A ready-to-import Sentinel workbook covering these views is available: sentinel-alphyn-workbook.json. In Sentinel, open Workbooks > Add workbook > Edit > Advanced Editor and paste the JSON.