Microsoft Sentinel × Sentiqra

Ingest Sentiqra classifications into Microsoft Sentinel and apply your own analytics and correlation rules downstream.

Why This Integration Matters

Microsoft Sentinel is the fastest-growing cloud-native SIEM, especially in enterprises already standardised on Microsoft security stack. For buyers running Sentinel, a documented integration path is essential - they will not deploy a detection API that requires custom ingestion engineering.

Sentinel uses Log Analytics workspaces as its data store, with KQL (Kusto Query Language) for detection rules. By publishing the Sentiqra log format, sample KQL analytics rules, and workbook templates, SOC teams can deploy Sentiqra detections into Sentinel in minutes, not weeks.

Inclusion in Microsoft App Source - Sentinel's integration marketplace - means enterprise buyers discover Sentiqra through Microsoft's own procurement channels.

Reference Architecture

┌──────────────────────────────────────────────────────────────┐
│                Azure Infrastructure                          │
│                                                               │
│  ┌──────────┐    ┌──────────────┐    ┌──────────┐           │
│  │ Sentiqra  │───▶│ Azure Logic  │───▶│ Log       │           │
│  │ Detection │    │ App /        │    │ Analytics │           │
│  │           │    │ Function App │    │ Workspace │           │
│  │           │    │              │    │           │           │
│  │           │    │ Transforms   │    │ Custom    │           │
│  │           │    │ JSON →       │    │ Log Table:│           │
│  │           │    │ Sentinel     │    │ Sentiqra  │           │
│  │           │    │ format       │    │ Detection │           │
│  └──────────┘    └──────────────┘    └─────┬─────┘           │
│                                            │                   │
│                              ┌─────────────▼──────────┐       │
│                              │ Microsoft Sentinel     │       │
│                              │ - Analytics rules (KQL)│       │
│                              │ - Workbooks            │       │
│                              │ - Incidents            │       │
│                              │ - Automation rules     │       │
│                              └────────────────────────┘       │
└──────────────────────────────────────────────────────────────┘

Data flow: Sentiqra detection results are sent to an Azure Logic App or Function App → the transformer maps the response to a custom log table in Log Analytics → Sentinel analytics rules (KQL) evaluate the events → matching rules create incidents → automation rules trigger response playbooks.

Working Code

Actual, tested, copy-pasteable code. Not pseudocode. Not aspirational.

from azure.identity import DefaultAzureCredential
from azure.monitor.ingestion import LogsIngestionClient
import hashlib, datetime, os, requests

credential = DefaultAzureCredential()
client = LogsIngestionClient(
    endpoint="https://your-dce.ingest.monitor.azure.com",
    credential=credential,
)

def analyze(text):
    response = requests.post(
        "https://sentiqra.tech/v1/analyze",
        headers={
            "Authorization": f"Bearer {os.environ['SENTIQRA_API_KEY']}",
            "Content-Type": "application/json",
        },
        json={"text": text, "language": "en", "analyzers": ["cybersecurity"]},
        timeout=10,
    )
    return response.json()

def send_to_sentinel(data, text):
    top = data["signals"][0] if data["signals"] else None
    client.upload(
        rule_id="your-dcr-immutable-id",
        stream_name="Custom-SentiqraDetection_CL",
        logs=[{
            "TimeGenerated": datetime.datetime.now(datetime.timezone.utc).isoformat(),
            "TextHash": hashlib.sha256(text.encode()).hexdigest()[:16],
            "Analyzer": top["analyzer"] if top else "cybersecurity",
            "TopSignal": top["code"] if top else None,
            "TopScore": top["score"] if top else 0.0,
            "ConfigId": data.get("verification", {}).get("configuration", ""),
        }],
    )

text = "click here to verify your account"
send_to_sentinel(analyze(text), text)

SentiqraDetection_CL
| where TopSignal == "phishing" and TopScore > 0.8
| summarize DetectionCount = count() by bin(TimeGenerated, 5m), TextHash
| where DetectionCount >= 3
| extend Severity = iff(TopScore > 0.9, "High", "Medium")
| project TimeGenerated, TextHash, DetectionCount, Severity

Security & Compliance Posture

• ✓
  NIS2 Article 21 - Incident Reporting: Sentinel incidents can provide timestamped evidence relevant to cybersecurity incident reporting obligations, with automated escalation via Sentinel automation rules.
• ✓
  Azure Native Integration: Uses managed identity for authentication to Log Analytics - no credentials in code. Integrates with Azure Monitor, Logic Apps, and Playbooks.
• ✓
  SOC 2 Type II - CC7.2 - Monitoring: Sentinel workbooks provide dashboards for Sentiqra detection rates, confidence distributions, and trend analysis - evidence that may support monitoring controls.
• ✓
  Microsoft App Source: Publishing as a Sentinel data connector enables enterprise buyers to install the integration directly from the Azure portal.
• ✓
  MITRE ATT&CK Mapping: Sentiqra's cyber threat groups can be mapped to MITRE ATT&CK techniques in Sentinel for correlation with other security signals.

Deployment Notes