Sentinel Push Feature Enables Easier Partner Integration

Microsoft Sentinel, the company’s hosted security information and event management (SIEM) system, connects numerous external data sources to the customer’s workspace to give a single security operations perspective over the data. This functionality helps customers discover security incidents and patterns more rapidly.

Historically, Sentinel relied on manually polling web-facing REST API endpoints to pull data from external systems on a scheduled basis. However, this process creates a lag in log data during the polling downtime that can create blind spots in security operations and increase both discovery and response times when incidents occur. Microsoft offers a push model for external data ingestion into Sentinel, but this requires some development and configuration effort by the external data source vendor and the Sentinel customer to specify sources, rules, Entra app registrations, and client secrets, among other things. 

The objective of the codeless connector framework (CCF) push concept (currently still in a long-running preview) is to enable rapid integration into Sentinel by providing a streamlined, point-and-shoot approach to wiring external data sources into Sentinel’s native Log Ingestion API. All data source configuration lives within Sentinel’s Content Hub, which allows customers to specify the connectors they would like to integrate. Building a CCF push connector involves creation of Azure Resource Manager templates by the vendor, which in turn are used to enable large-scale data ingestion and transformation of JSON-based log data directly into Sentinel system tables. The framework established using CCF push is also intended to help future-proof these connectors by preparing Sentinel for further integration enhancements from that data source, including integration with external data lakes and ingestion of agentic AI log data.