# Send Events to Microsoft Sentinel SIEM - Link: https://www.agilicus.com/anyx-guide/send-events-to-microsoft-sentinel/ - Published: 2026-03-10T16:19:58+00:00 - Author: Kyle Larose 1. [Home](https://www.agilicus.com/) 2. Send Events to Microsoft Sentinel SIEM ![anyx-sentinel-memphis](https://www.agilicus.com/www/ec8dcd21-anyx-sentinel-memphis. svg) ## Send Events to Microsoft Sentinel SIEM Configure Agilicus AnyX to send events to Microsoft Sentinel. [CONTACT](https://www.agilicus.com/contact-us/) ## Example: Send Events to Microsoft Sentinel Agilicus AnyX [supports sending](https://www.agilicus.com/anyx-guide/audit-destination/) auditing information to external systems. Configuring Microsoft Sentinel as one of those destinations is fairly straightforward. AnyX integrates with Sentinel using a Microsoft [Codeless Connector Framework Push connector](https://learn.microsoft.com/en-us/azure/sentinel/create-push-codeless-connector), which sets up an endpoint capable of ingesting events in your Sentinel workspace. In this example, we will show how to deploy one of these connectors in Sentinel, and how to configure AnyX to send to it. You will deploy a template in Azure, and configure a [destination](https://www.agilicus.com/anyx-guide/audit-destination/) in your admin portal. AnyX will authenticate with Azure using a [Certificate credential-based App Registration](https://learn.microsoft.com/en-us/entra/identity-platform/certificate-credentials#register-your-certificate-with-microsoft-identity-platform). ## Deploying in Azure Log in to Azure, then open the template by clicking [this link](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fwww.agilicus.com%2Fwww%2Freleases%2Fmicrosoft-defender-integration%2Fanyx-solution%2Fanyx-push-connector-deploy.json). Azure will fetch the deployment template from Agilicus. Follow these instructions to fill it in to create the connector in your workspace. The deployment link will send you to the “Custom deployment” page in Azure. Choose the resource group in which you have your Sentinel workspace. Fill in the location you want the Push connector to run — ideally somewhere central to your AnyX connectors, and set the workspace to the name of the Sentinel workspace. ![An image showing a custom template deployment in Azure](https://www.agilicus.com/ www/a4c7c085-bfc26ba53cab24ae1421655d88054b58.png) Click Review + Create to review the deployment, then create it. You will be moved to this page, which summarises the deployment. ![An image showing a successful template deployment](https://www.agilicus.com/www/ 064feecb-ae4ce0448c3490712cdb47e7f51e690e.png) Now navigate to your Sentinel instance, then to Configuration-> Data connectors. Hit Refresh if the Agilicus Anyx (Push) is not yet there. Click on it, then click“ Open connector page”. ![An image showing the Sentinel data connector configuration](https://www.agilicus. com/www/8dc5276e-4ed14504280d6b1ddeadc392807f2cf6.png) From there, click “Deploy AnyX Push connector resources”. Click OK if it prompts about creating non-existent resources. ![An image showing the Agilicus AnyX Push connector deployment page prior to deployment]( https://www.agilicus.com/www/7549d5e4-029744f36f3a5454e00feb919f069c05.png) ![An image showing the Agilicus AnyX Push connector deployment page after successful deployment with the resulting parameters](https://www.agilicus.com/www/c19679bb- connector-details.png) Once the deploy has finished, you will be provided with some information you will need to use to configure AnyX. Be sure to copy down the fields it provides. Next we need to create the certificate and private key used to authenticate, then upload the certificate to azure. First, create the certificate. Make sure to fill in the details in the -subj command. ```wp-block-code openssl req -new -x509 -nodes -newkey ec:<(openssl ecparam -name prime256v1 -genkey) -keyout ms-sentinel.ec.key.pem -out ms-sentinel.ec.crt -days 36500 -subj "/C=/ST=/L=/O=/CN=ms-sentinel-push-connector." ``` This will create a private key in ms-sentinel.ec.key.pem and a certificate in ms- sentinel.ec.crt. Then generate the fingerprint for the certificate. AnyX will use this to tell Sentinel which certificate to validate against. Copy down the fingerprint. You will paste it into the AnyX configuration later. It will look something like _2fYsVtd9aIioYlfa3\ _IgqN72M3O0opRdT2Ypk0AXnDY=_ ```wp-block-code openssl x509 -in /tmp/ms-sentinel/ms-sentinel.ec.crt -outform DER | openssl dgst -sha256 -binary | basenc --base64url -w 0 ``` Next, upload the certificate to Azure. Navigate to App Registrations, select All applications, then paste the Audit Destination Client ID you copied down earlier into filter bar. ![Microsoft Azure App Registrations page showing the Agilicus AnyX Push Connector]( https://www.agilicus.com/www/711f44f2-584f7d3ddb17b508dbc8a801af2be44f.png) Select the Application, then select Certificates & secrets from the menu. Select the Certificates tab, then click “Upload ![Microsoft Azure App Registrations page showing uploading a certificate](https:// www.agilicus.com/www/a0414550-2394fb93fd17174c984b26d37973194f.png) Microsoft Azure App Registrations page showing uploading a certificate Choose the certificate you created earlier. E.g. ms-sentinel.ec.crt. It will appear in the list of certificates. Next we need to configure a Destination in AnyX. Navigate to your AnyX admin portal, then to Organisation -> Audit Destinations. Click “Add Destination” Set the following parameters: * name: ms-sentinel * type: webhook * Location: * Authentication Type: OAuth2 Check off the types of logs you want to send. ![An image showing configuration of an audit destination targeting Microsoft Sentinel]( https://www.agilicus.com/www/a8c58934-6b1873c1df038fb4f4a75731b152455a.png) Next, click Actions->Manage Credentials on the new destination. Enter the following information, then click Save. * Private Key: * Client ID: * Token URL: * Scopes: * Fingerprint: ![The credentials dialog showing private key configuration](https://www.agilicus. com/www/d2695ef0-cert-creds.png) AnyX will start publishing records to Sentinel in a few minutes. To test connectivity, first generate some activity by accessing an AnyX resource such as a share. Then, Navigate to the “log analytics” link from the newly deployed connector in Azure. ![An image showing a connected Push connector in Microsoft Sentinel](https://www. agilicus.com/www/0303be54-ea691fe9e492037b6f4f9b21a5ba96c9-1024x487.png) ![An image showing a graph of events received by an AnyX Push connector](https:// www.agilicus.com/www/1bf55fcb-34341836131fe0333d0166c3420f7be4-1024x487.png) To view details, click the + beside the “New Query” tab to open a new query. Select“ KQL mode” instead of simple mode then enter the following query and run it: ```wp-block-code AgilicusUnifiedEvents_CL ``` ![An image showing a table and query of all events received by a push connector]( https://www.agilicus.com/www/2f462b70-39dcaafd11d0dd5ae817eda6f0f18994-1024x506. png) This shows you all the events coming from Agilicus. To see only access logs, run ```wp-block-code AgilicusUnifiedEvents_CL | where LogType == "access" ``` ![An image showing a table and query of access log events received by a push connector]( https://www.agilicus.com/www/cf869a4c-59a88a21b0b6b4bc59eb553600e7f16b-1024x484. png) To see only authorization logs, run ```wp-block-code AgilicusUnifiedEvents_CL | where LogType == "authorization" ``` ![An image showing a table and query of authorization events received by a push connector](https://www.agilicus.com/www/5cd849ff-446f32817d20424d4b668a375557a220- 1024x484.png) To see only unstructured logs, run ```wp-block-code AgilicusUnifiedEvents_CL | where LogType == "logs" ``` ![An image showing a table and query of unstructured log events received by a push connector](https://www.agilicus.com/www/253ab11c-6c8adc7aff4e50f074ec5194756f2f11. png)