Copy page

Outputs

Microsoft Azure Sentinel (v2)

Sends data to Microsoft Sentinel (Azure Monitor Logs) for querying and alerting.

Overview

This output ingests records into Microsoft Sentinel through the Azure Monitor Logs Ingestion API, targeting a Data Collection Rule (DCR) and a stream defined on it. You choose how the DCR is provided:

• Manual — you supply a single DCR and Monad ingests into it.
• Managed — you supply a DCR's ARM resource ID and Monad manages the DCRs for you: it creates additional DCRs when needed to scale ingestion for higher throughput, and deletes them automatically as part of cleanup.

Individual records above 1 MB are rejected.

Requirements

• An onboarded Log Analytics workspace with at least contributor rights.
• Permissions to create DCR objects in the workspace.
• Assign the Monitoring Metrics Publisher role to the registered application on the DCR (DCR → Access control (IAM) → Add role assignment), so Monad can send data to it.
• Managed mode only: assign the Monitoring Metrics Contributor role to the registered application on the resource group that contains your DCR (resource group → Access control (IAM) → Add role assignment), so Monad can create and manage DCRs on your behalf. The application also needs permission to read, create, and delete Data Collection Rules under the workspace's subscription (Azure Resource Manager access).

Setup

1. Create a Microsoft Entra application and note the Application (Client) ID, Directory (Tenant) ID, and a Client Secret value.
2. Create a Data Collection Endpoint and copy its Logs Ingestion URI (used as Endpoint URL).
3. Create a table in your Log Analytics workspace, uploading a sample JSON array matching the data you'll ingest.
4. Choose a DCR mode — manual (supply the DCR's immutable Rule ID) or managed (supply the DCR's full ARM DCR Resource ID).

Configuration

Settings

Setting	Type	Required	Description
Endpoint URL	string	Yes	The Azure Monitor DCR ingestion endpoint URL.
Stream Name	string	Yes	The name of the data stream defined in the DCR.
DCR Configuration	one of	Yes	How the DCR is provided: manual or managed.

Manual — Rule ID (string, required): the immutable identifier of the DCR.

Managed — DCR Resource ID (string, required): the full ARM resource ID of your DCR (/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Insights/dataCollectionRules/<name>).

Secrets

Secret	Type	Required	Description
Tenant ID	string	Yes	The Azure Active Directory tenant (directory) ID.
Client ID	string	Yes	The application (client) ID registered in Azure Active Directory.
Client Secret	string	Yes	The client secret associated with the registered application in Azure AD.

Finding Your Configuration Values

• Rule ID: Monitor → Data Collection Rules → select your DCR → JSON View → immutableId.
• DCR Resource ID: Monitor → Data Collection Rules → select your DCR → JSON View → top-level id.
• Stream Name: follows the pattern Custom-[TableName]_CL. Find it under the DCR's properties.streamDeclarations, or add the Custom- prefix to your custom table name.

Troubleshooting

• Records rejected for size: records above 1 MB are rejected — trim or split large records upstream.
• Managed mode fails to set up a DCR: confirm the application can read, create, and delete Data Collection Rules under the target subscription, and that the DCR Resource ID is valid.
• Data not appearing: verify the Stream Name matches a stream declared on the DCR and that the table schema matches the ingested records.

Related Articles

Azure Monitor Logs Ingestion API