Security · Beta

Microsoft Sentinel
API integration

Ship Security features without building the integration. Full Microsoft Sentinel API access via Proxy and 90+ MCP-ready tools for AI agents — extend models and mappings to fit your product.

Built for specific customer use cases. Issues are resolved quickly.

Talk to us

Use Cases

Why integrate with Microsoft Sentinel

Common scenarios for SaaS companies building Microsoft Sentinel integrations for their customers.

Embed bi-directional incident sync in your ITSM or ticketing product

Give customers running SOCs on Sentinel a native way to mirror incidents, comments, assignments, and status changes into your platform. Analysts can work from your UI while Sentinel stays authoritative, without your team maintaining Azure Resource Manager auth or incident schema quirks.

Stream threat intelligence into customer Sentinel workspaces

If you sell a threat intel or EDR SaaS, push curated IOCs — IPs, URLs, hashes, domains — directly into each customer's Sentinel threat intel blade. Truto handles the per-tenant auth so your indicators land in the right workspace with the right tags.

Sync HR, identity, and asset context into Sentinel Watchlists

HR, IGA, ITAM, and CSPM products can keep Sentinel Watchlists continuously updated with terminated employees, VIPs, crown-jewel assets, or vulnerable devices. This turns your source-of-truth data into high-fidelity detection context for the customer's SOC.

Trigger Sentinel playbooks from your security product

CSPM, DSPM, EDR, and SOAR-adjacent SaaS tools can execute customer-defined Sentinel playbooks against specific incidents or entities when they detect an issue. This lets your product drive remediation inside the Microsoft ecosystem without rebuilding Logic Apps logic.

Offer MSSP-grade multi-tenant Sentinel management

MSSP tooling and reporting SaaS can list subscriptions and workspaces per customer and operate across them from one surface. Truto manages the Azure OAuth and tenant isolation so you can focus on cross-client analytics and workflows.

What You Can Build

Ship these features with Truto + Microsoft Sentinel

Concrete product features your team can ship faster by leveraging Truto’s Microsoft Sentinel integration instead of building from scratch.

Two-way incident sync with comments and tasks

Mirror Sentinel incidents into your app and push back status, owner, comments, and incident tasks using the incidents, incident comments, and incident tasks endpoints.

Threat intelligence indicator pipeline

Create, query, tag, and delete Sentinel threat intel indicators so your platform can continuously manage the lifecycle of IOCs inside each customer's workspace.

Watchlist sync for context enrichment

Programmatically create and update Sentinel Watchlists and Watchlist Items from your HR, identity, or asset data, with support for bulk refreshes on a schedule.

Playbook execution from your UI

Let users trigger Sentinel playbooks against specific incidents or entities directly from your product, with the Logic App run initiated via Sentinel's run-playbook endpoints.

Detection rule and analytics management

Expose Sentinel alert rules, alert rule templates, and ML analytics settings in your app so customers can view, edit, or deploy detections without leaving your product.

Threat-hunting bookmark publisher

Push hunt findings and KQL query results from your analytics platform into Sentinel as bookmarks so analysts can promote them to incidents later.

SuperAI

Microsoft Sentinel AI agent tools

Comprehensive AI agent toolset with fine-grained control. Integrates with MCP clients like Cursor and Claude, or frameworks like LangChain.

list_all_microsoft_sentinel_operations

List all operations available for the Azure Security Insights (Microsoft Sentinel) Resource Provider. Returns: display, name, origin, isDataAction.

list_all_microsoft_sentinel_alert_rule_templates

List all alert rule templates in a Microsoft Sentinel workspace. Returns each template's kind. Required: workspace_name.

get_single_microsoft_sentinel_alert_rule_template_by_id

Get a single alert rule template in a Microsoft Sentinel workspace by id. Returns the template's kind. Required: id, workspace_name.

list_all_microsoft_sentinel_alert_rules

List all Microsoft Sentinel alert rules in a Log Analytics workspace. Returns each rule's kind and etag. Required: workspace_name.

get_single_microsoft_sentinel_alert_rule_by_id

Get a Microsoft Sentinel alert rule by id in a workspace. Returns: kind, etag. Required: id, workspace_name.

update_a_microsoft_sentinel_alert_rule_by_id

Create or update a Microsoft Sentinel alert rule by id (upsert). Returns the saved rule's kind and etag. Required: id, workspace_name, kind.

delete_a_microsoft_sentinel_alert_rule_by_id

Delete a Microsoft Sentinel alert rule by id within a Log Analytics workspace. Returns an empty 204 response on success. Required: id, workspace_name.

list_all_microsoft_sentinel_actions

List all actions of a Microsoft Sentinel alert rule. Returns: properties, etag. Required: workspace_name, rule_id.

get_single_microsoft_sentinel_action_by_id

Get a single action of a Microsoft Sentinel alert rule by id. Returns: properties, etag. Required: id, workspace_name, rule_id.

update_a_microsoft_sentinel_action_by_id

Create or update an action of a Microsoft Sentinel alert rule by id. Returns: properties, etag. Required: id, workspace_name, rule_id.

delete_a_microsoft_sentinel_action_by_id

Delete the action of an alert rule in Microsoft Sentinel. Returns an empty 204 response on success. Required: id, workspace_name, rule_id.

list_all_microsoft_sentinel_automation_rules

List all automation rules in a Microsoft Sentinel workspace. Returns each rule's etag and properties. Required: workspace_name.

get_single_microsoft_sentinel_automation_rule_by_id

Get a single Microsoft Sentinel automation rule by id. Returns: properties, etag. Required: id, workspace_name.

update_a_microsoft_sentinel_automation_rule_by_id

Create or update a Microsoft Sentinel automation rule by id. Returns the rule's etag and properties. Required: id, workspace_name, properties.

delete_a_microsoft_sentinel_automation_rule_by_id

Delete a Microsoft Sentinel automation rule by id. Returns an empty 204 response on success. Required: id, workspace_name.

list_all_microsoft_sentinel_bookmarks

List all bookmarks in a Microsoft Sentinel workspace. Returns each bookmark with its id, etag, and bookmark properties including display name, query, labels, notes, created/updated times and users, event time, query window, and incident info. Required: workspace_name.

get_single_microsoft_sentinel_bookmark_by_id

Get a Microsoft Sentinel bookmark by its bookmark ID. Returns the bookmark with its id, etag, and bookmark properties including display name, query, labels, notes, created/updated times and users, event time, query window, and incident info. Required: id, workspace_name.

update_a_microsoft_sentinel_bookmark_by_id

Create or update a Microsoft Sentinel bookmark by id. Returns: properties, etag. Required: id, workspace_name.

delete_a_microsoft_sentinel_bookmark_by_id

Delete a Microsoft Sentinel bookmark by id. Returns an empty 204 response on success. Required: id, workspace_name.

list_all_microsoft_sentinel_content_packages

List all installed content packages in a Microsoft Sentinel workspace. Returns per package: properties, etag. Required: workspace_name.

get_single_microsoft_sentinel_content_package_by_id

Get an installed content package by id in a Microsoft Sentinel workspace. Returns: properties, etag. Required: id, workspace_name.

update_a_microsoft_sentinel_content_package_by_id

Install a content package to a Microsoft Sentinel workspace by id (PUT). Returns the installed package: properties, etag. Required: id, workspace_name.

delete_a_microsoft_sentinel_content_package_by_id

Uninstall (delete) a Microsoft Sentinel content package from a Log Analytics workspace by id. Returns an empty 204 response on success. Requires id, subscription_id, resource_group_name, and workspace_name. Required: id, workspace_name.

list_all_microsoft_sentinel_content_product_packages

List all content product packages in the Microsoft Sentinel catalog for a workspace. Returns each package's id, name, etag, and properties (displayName, contentKind, installedVersion). properties/installed and properties/packagedContent are expandable. Required: workspace_name.

get_single_microsoft_sentinel_content_product_package_by_id

Get a content product package from the Microsoft Sentinel catalog by id. Returns the package's id, name, etag, and properties (displayName, contentKind, installedVersion, packagedContent). Required: id, workspace_name.

list_all_microsoft_sentinel_content_product_templates

List all templates in the Microsoft Sentinel content catalog for a workspace. Returns catalog template records with their ARM id, name, type, systemData, etag, and template property bag. Required: workspace_name.

list_all_microsoft_sentinel_content_templates

List all installed content templates in a Microsoft Sentinel workspace. Returns each template with its properties and etag. Required: workspace_name.

get_single_microsoft_sentinel_content_template_by_id

Get a single content template by id in a Microsoft Sentinel workspace. Returns the template with its properties and etag. Required: id, workspace_name.

update_a_microsoft_sentinel_content_template_by_id

Install a content template in a Microsoft Sentinel workspace. Returns the installed template with its properties and etag. Required: id, workspace_name.

delete_a_microsoft_sentinel_content_template_by_id

Delete an installed Microsoft Sentinel content template by id from the specified Log Analytics workspace. Returns an empty 204 response on success. Required: id, workspace_name.

get_single_microsoft_sentinel_contentproducttemplate_by_id

Get a Microsoft Sentinel content product template by id in the specified workspace. Returns: properties, etag. Required: id, workspace_name.

list_all_microsoft_sentinel_data_connector_definitions

List all Microsoft Sentinel data connector definitions in a Log Analytics workspace. Returns: kind, etag. Required: workspace_name.

get_single_microsoft_sentinel_data_connector_definition_by_id

Get a single Microsoft Sentinel data connector definition by id (its data connector definition name). Returns: kind, etag. Required: id, workspace_name.

update_a_microsoft_sentinel_data_connector_definition_by_id

Create or update a Microsoft Sentinel data connector definition by id. Returns: kind, etag. Required: id, workspace_name, kind.

delete_a_microsoft_sentinel_data_connector_definition_by_id

Delete a Microsoft Sentinel data connector definition. Returns an empty 204 response on success. Required: id, workspace_name.

list_all_microsoft_sentinel_data_connectors

List all data connectors in a Microsoft Sentinel workspace. Returns connectors with their id, kind, and etag. Required: workspace_name.

get_single_microsoft_sentinel_data_connector_by_id

Get a single data connector in a Microsoft Sentinel workspace by connector id. Returns: kind, etag. Required: id, workspace_name.

update_a_microsoft_sentinel_data_connector_by_id

Create or update a Microsoft Sentinel data connector by id. Returns: kind, etag. Required: id, workspace_name, kind.

delete_a_microsoft_sentinel_data_connector_by_id

Delete a Microsoft Sentinel data connector by id. Returns an empty 204 response on success. Required: id, workspace_name.

create_a_microsoft_sentinel_entitie_run_playbook

Run a Microsoft Sentinel playbook (Logic App) on a specific entity. Returns an empty 204 response on success. Required: workspace_name, entity_identifier, logicAppsResourceId.

list_all_microsoft_sentinel_incidents

List all Microsoft Sentinel incidents in a workspace. Returns incident records with their properties and etag. Max 1000 per page. Required: workspace_name.

get_single_microsoft_sentinel_incident_by_id

Get a single Microsoft Sentinel incident by id. Returns the incident with its properties and etag. Required: id, workspace_name.

update_a_microsoft_sentinel_incident_by_id

Create or update a Microsoft Sentinel incident by id; a new incident is created when the id does not exist. Returns the incident with its properties and etag. Required: id, workspace_name.

delete_a_microsoft_sentinel_incident_by_id

Delete a Microsoft Sentinel incident from the specified Log Analytics workspace by id. Returns an empty 204 response on success. Required: id, workspace_name.

list_all_microsoft_sentinel_incident_alerts

List all alerts for a Microsoft Sentinel incident. Returns: kind, properties. Required: workspace_name, incident_id.

list_all_microsoft_sentinel_incident_bookmarks

List the bookmarks linked to a Microsoft Sentinel incident. Returns the list of bookmarks, each with its id and bookmark attributes. Required: workspace_name, incident_id.

get_single_microsoft_sentinel_incident_comment_by_id

Get a Microsoft Sentinel incident comment by id. Returns the comment with its properties and etag. Required: id, workspace_name, incident_id.

update_a_microsoft_sentinel_incident_comment_by_id

Create or update a comment for a Microsoft Sentinel incident. Returns the comment with its properties and etag. Required: id, workspace_name, incident_id.

delete_a_microsoft_sentinel_incident_comment_by_id

Delete an incident comment from a Microsoft Sentinel incident. Returns an empty 204 response on success. Required: id, workspace_name, incident_id.

list_all_microsoft_sentinel_incident_comments

List all comments for a Microsoft Sentinel incident. Returns comments with their properties and etag. Required: workspace_name, incident_id.

list_all_microsoft_sentinel_incident_entities

List all entities associated with a Microsoft Sentinel incident. Returns each entity including its id and kind-specific attributes. Required: workspace_name, incident_id.

list_all_microsoft_sentinel_incident_relations

List all relations for a given Microsoft Sentinel incident. Returns each relation with its properties and etag. Required: workspace_name, incident_id.

get_single_microsoft_sentinel_incident_relation_by_id

Get a relation for a Microsoft Sentinel incident by id. Returns the relation with its properties and etag. Required: id, workspace_name, incident_id.

update_a_microsoft_sentinel_incident_relation_by_id

Create or update a relation for a Microsoft Sentinel incident by id. Returns the relation with its properties and etag. Relation id must be 3-63 alphanumeric characters or dashes. Required: id, workspace_name, incident_id.

delete_a_microsoft_sentinel_incident_relation_by_id

Delete a relation for a given incident in Microsoft Sentinel. Returns an empty 204 response on success. Required: id, workspace_name, incident_id.

create_a_microsoft_sentinel_incident_run_playbook

Run a playbook on a specific Microsoft Sentinel incident. Returns an empty 204 response on success. Required: workspace_name, incident_identifier, logicAppsResourceId.

list_all_microsoft_sentinel_incident_tasks

List all tasks for a Microsoft Sentinel incident. Returns each task's properties (title, status, createdTimeUtc, lastModifiedTimeUtc, createdBy, lastModifiedBy), etag, and resource id, name, and type. Required: workspace_name, incident_id.

get_single_microsoft_sentinel_incident_task_by_id

Get a single task on a Microsoft Sentinel incident by id. Returns the task's properties (title, status, createdTimeUtc, lastModifiedTimeUtc, createdBy, lastModifiedBy), etag, and resource id, name, and type. Required: id, workspace_name, incident_id.

update_a_microsoft_sentinel_incident_task_by_id

Create or update a task on a Microsoft Sentinel incident by id (upsert). Returns: properties, etag. Required: id, workspace_name, incident_id, properties.

delete_a_microsoft_sentinel_incident_task_by_id

Delete a Microsoft Sentinel incident task by id. Returns an empty 204 response on success. Required: id, workspace_name, incident_id.

list_all_providers_microsoft_security_insights

List Microsoft Sentinel repository metadata for a workspace. Returns: url, fullName, installationId, branches. Required: workspace_name, properties.

list_all_microsoft_sentinel_metadata

List all Microsoft Sentinel metadata in the specified workspace. Returns metadata records with their id, properties, and etag. Required: workspace_name.

get_single_microsoft_sentinel_metadatum_by_id

Get a Microsoft Sentinel metadata item by id. Returns the metadata record with its id, properties, and etag. Required: id, workspace_name.

create_a_microsoft_sentinel_metadatum

Create a Microsoft Sentinel metadata item in the specified workspace. Returns the created metadata record with its id, properties, and etag. Required: workspace_name, metadata_name.

microsoft_sentinel_metadata_bulk_update

Update an existing Microsoft Sentinel metadata item in the specified workspace. Returns the updated metadata record with its id, properties, and etag. Required: workspace_name, metadata_name.

microsoft_sentinel_metadata_bulk_delete

Delete a Microsoft Security Insights metadata item from the specified Operational Insights workspace. Returns an empty 204 response on success. Required: workspace_name, metadata_name.

list_all_microsoft_sentinel_onboarding_states

List all Microsoft Sentinel onboarding states in a Log Analytics workspace. Returns: properties, etag. Required: workspace_name.

get_single_microsoft_sentinel_onboarding_state_by_id

Get a Microsoft Sentinel onboarding state by id. Returns: properties, etag. The onboarding state name supports 'default'. Required: id, workspace_name.

create_a_microsoft_sentinel_onboarding_state

Create or update a Microsoft Sentinel onboarding state in a Log Analytics workspace. Returns: properties, etag. The onboarding state name supports 'default'. Required: workspace_name, sentinel_onboarding_state_name.

microsoft_sentinel_onboarding_states_bulk_delete

Delete a Microsoft Sentinel onboarding state for a Log Analytics workspace. Returns an empty 204 response on success. Required: workspace_name, sentinel_onboarding_state_name.

list_all_microsoft_sentinel_security_ml_analytics_settings

List all Security ML Analytics Settings for a Microsoft Sentinel workspace. Returns one setting record per item: kind, etag. Required: workspace_name.

get_security_ml_analytics_setting_by_id

Get a single Security ML Analytics Settings resource by id in Microsoft Sentinel. Returns: kind, etag. Required: id, workspace_name.

microsoft_sentinel_security_ml_analytics_settings_bulk_update

Create or update a Security ML Analytics Settings resource in Microsoft Sentinel. Returns: kind, etag. Required: workspace_name, settings_resource_name, kind.

microsoft_sentinel_security_ml_analytics_settings_bulk_delete

Delete a Security ML Analytics Settings resource in Microsoft Sentinel by resource name. Returns an empty 204 response on success. Required: workspace_name, settings_resource_name.

list_all_microsoft_sentinel_sourcecontrols

List all source controls in a Microsoft Sentinel workspace. Returns: properties, etag. Source control items are not included. Required: workspace_name.

get_single_microsoft_sentinel_sourcecontrol_by_id

Get a single source control by id in a Microsoft Sentinel workspace. Returns: properties, etag. Required: id, workspace_name.

create_a_microsoft_sentinel_sourcecontrol

Create a source control in a Microsoft Sentinel workspace. Returns the created source control with its properties and etag. Required: workspace_name, sourcecontrol_id, properties.

delete_a_microsoft_sentinel_sourcecontrol_delete_by_id

Delete a source control connection in Microsoft Sentinel by id (the source control id). Returns: warning — details of any cleanup Sentinel could not do automatically (service principal, pipeline, workflow or secret, role assignment). Required: id, workspace_name, subscription_id, resource_group_name, properties (repository access credentials).

create_a_microsoft_sentinel_main_create_indicator

Create a new threat intelligence indicator in Microsoft Sentinel. Returns the created indicator resource: id, name, type, properties. Required: workspace_name, kind.

list_all_microsoft_sentinel_main_indicators

List all threat intelligence indicators in a Microsoft Sentinel workspace. Returns indicators with their kind and etag. Required: workspace_name.

get_single_microsoft_sentinel_main_indicator_by_id

Get a single Microsoft Sentinel threat intelligence indicator by id (the indicator name). Returns the indicator's kind and etag. Required: id, workspace_name.

create_a_microsoft_sentinel_main_indicator

Create or update a Microsoft Sentinel threat intelligence indicator identified by name. Returns the indicator's kind and etag. Required: workspace_name, name, kind.

delete_a_microsoft_sentinel_main_indicator_by_id

Delete a Microsoft Sentinel threat intelligence indicator by id. Returns an empty 204 response on success. Required: id, workspace_name.

create_a_microsoft_sentinel_indicator_append_tag

Append tags to a threat intelligence indicator in Microsoft Sentinel. Returns a 200 response with an empty body on success. Required: workspace_name, name.

create_a_microsoft_sentinel_indicator_replace_tag

Replace the tags on a Microsoft Sentinel threat intelligence indicator identified by name. Returns: kind, etag. Required: workspace_name, name, kind.

list_all_microsoft_sentinel_main_metrics

List threat intelligence indicator metrics for a Microsoft Sentinel workspace. Returns metric records whose properties object holds indicator counts by type, threat type, and source. Required: workspace_name.

create_a_microsoft_sentinel_main_query_indicator

Query Microsoft Sentinel threat intelligence indicators by filtering criteria such as confidence, sources, pattern types, threat types, and keywords. Returns matching indicators with their kind and etag. Required: workspace_name.

list_all_microsoft_sentinel_watchlists

List Microsoft Sentinel watchlists for a workspace, without their watchlist items. Returns watchlist records with properties and etag. Required: workspace_name.

get_single_microsoft_sentinel_watchlist_by_id

Get a single Microsoft Sentinel watchlist by id (its watchlist alias), without its watchlist items. Returns the watchlist with properties and etag. Required: id, workspace_name.

update_a_microsoft_sentinel_watchlist_by_id

Create or update a Microsoft Sentinel watchlist by id; to bulk-create the watchlist together with its watchlist items, pass rawContent and contentType (e.g. text/csv). Returns the watchlist with properties and etag. Required: id, workspace_name.

delete_a_microsoft_sentinel_watchlist_by_id

Delete a watchlist in Microsoft Sentinel by id (the watchlist alias). Returns an empty 204 response on success. Deletion is asynchronous — 202 Accepted, track via the Azure-AsyncOperation header. Required: id, workspace_name.

list_all_microsoft_sentinel_watchlist_watchlist_items

List all watchlist items in a Microsoft Sentinel watchlist. Returns: properties, etag. Required: workspace_name, watchlist_alias.

get_single_microsoft_sentinel_watchlist_watchlist_item_by_id

Get a Microsoft Sentinel watchlist item by id. Returns: properties, etag. Required: id, workspace_name, watchlist_alias.

update_a_microsoft_sentinel_watchlist_watchlist_item_by_id

Create or update a Microsoft Sentinel watchlist item by id. Returns: properties, etag. Required: id, workspace_name, watchlist_alias.

delete_a_microsoft_sentinel_watchlist_watchlist_item_by_id

Delete a watchlist item from a Microsoft Sentinel watchlist. Returns an empty 204 response on success. Required: id, workspace_name, watchlist_alias.

list_all_microsoft_sentinel_subscriptions

List the Azure subscriptions the connected identity can access. Use this first to find the subscription_id that every other Microsoft Sentinel tool needs. Returns: subscriptionId, displayName, state, tenantId. No parameters.

list_all_microsoft_sentinel_workspaces

List the Log Analytics workspaces in an Azure subscription. Microsoft Sentinel runs on a Log Analytics workspace, so use this to find workspace_name and resource_group_name: the workspace name is `name`, and the resource group is the segment after /resourceGroups/ in `id`. Returns: id, name, location, properties (customerId, provisioningState, sku, retentionInDays). Required: subscription_id.

list_all_microsoft_sentinel_solutions

List the monitoring solutions installed in an Azure subscription. A Log Analytics workspace has Microsoft Sentinel enabled when a solution named `SecurityInsights()` exists; its properties.workspaceResourceId points at that workspace. Returns: id, name, location, plan (name, product, publisher), properties (workspaceResourceId, provisioningState). Required: subscription_id.

Why Truto

Why use Truto’s MCP server for Microsoft Sentinel

Other MCP servers give you a static tool list for one app. Truto gives you a managed, multi-tenant MCP infrastructure across 900+ integrations.

Auto-generated, always up to date

Tools are dynamically generated from curated documentation — not hand-coded. As integrations evolve, tools stay current without manual maintenance.

Fine-grained access control

Scope each MCP server to read-only, write-only, specific methods, or tagged tool groups. Expose only what your AI agent needs — nothing more.

Multi-tenant by design

Each MCP server is scoped to a single connected account with its own credentials. The URL itself is the auth token — no shared secrets, no credential leaking across tenants.

Works with every MCP client

Standard JSON-RPC 2.0 protocol. Paste the URL into Claude, ChatGPT, Cursor, or any MCP-compatible agent framework — tools are discovered automatically.

Built-in auth, rate limits, and error handling

Tool calls execute through Truto’s proxy layer with automatic OAuth refresh, rate-limit handling, and normalized error responses. No raw API plumbing in your agent.

Expiring and auditable servers

Create time-limited MCP servers for contractors or automated workflows. Optional dual-auth requires both the URL and a Truto API token for high-security environments.

How It Works

From zero to integrated

Go live with Microsoft Sentinel in under an hour. No boilerplate, no maintenance burden.

Link your customer’s Microsoft Sentinel account

Use Truto’s frontend SDK to connect your customer’s Microsoft Sentinel account. We handle all OAuth and API key flows — you don’t need to create the OAuth app.

We handle authentication

Don’t spend time refreshing access tokens or figuring out secure storage. We handle it and inject credentials into every API request.

Call our API, we call Microsoft Sentinel

Truto’s Proxy API is a 1-to-1 mapping of the Microsoft Sentinel API. You call us, we call Microsoft Sentinel, and pass the response back in the same cycle.

Unified response format

Every response follows a single format across all integrations. We translate Microsoft Sentinel’s pagination into unified cursor-based pagination. Data is always in the result attribute.

FAQs

Common questions about Microsoft Sentinel on Truto

Authentication, rate limits, data freshness, and everything else you need to know before you integrate.

How does authentication to Microsoft Sentinel work?

Sentinel is an Azure resource, so authentication uses Microsoft Entra ID (Azure AD) OAuth against Azure Resource Manager. Truto handles the OAuth flow, token refresh, and scoping to the customer's subscription and Log Analytics workspace so your end users just click connect.

Does the integration support multiple subscriptions and workspaces per customer?

Yes. You can call list_all_microsoft_sentinel_subscriptions and list_all_microsoft_sentinel_workspaces to let the end user pick which workspace to connect, which is especially useful for enterprises and MSSPs managing many tenants.

Can we create and manage incidents, or only read them?

Full CRUD is supported on incidents, incident comments, incident tasks, and incident relations. You can also list incident alerts, bookmarks, and entities tied to an incident to build a complete investigation view.

How do we push threat intelligence indicators into Sentinel?

Use the create indicator endpoints to add IOCs, append or replace tags on them, query indicators, and delete them when they're deprecated — giving you a full lifecycle for threat intel feeds inside the customer's Sentinel instance.

Can our product trigger Sentinel playbooks?

Yes. Truto exposes endpoints to run a playbook against a specific incident or against an entity, so your app can orchestrate remediation using the customer's existing Azure Logic Apps.

How are rate limits and pagination handled?

Sentinel inherits Azure Resource Manager's throttling and uses nextLink-style pagination. Truto normalizes pagination across list endpoints and transparently handles retries and backoff so you don't have to code against ARM's quirks.

What about data connectors, analytics rules, and watchlists?

You can list, read, update, and delete data connectors and data connector definitions, alert rules, ML analytics settings, and watchlists plus their items — enough to build configuration and sync experiences on top of Sentinel.

Microsoft Sentinel

Get Microsoft Sentinel integrated into your app

Our team understands what it takes to make a Microsoft Sentinel integration successful. A short, crisp 30 minute call with folks who understand the problem.