Skip to main content

​
What Cymph uses it for

Cymph connects to Microsoft Sentinel to read your analytics/detection rules and map their MITRE ATT&CK techniques, so a preset’s scope can be derived from what you actually detect. See Manage presets for the detection-based scope option. All operations are read-only — Cymph never modifies rules, incidents, or workspace configuration. Authentication uses an Entra ID app registration (client-credentials flow) against the Azure Resource Manager API. Access is therefore controlled by Azure RBAC role assignments.

​
Requirements

After you enter the Tenant ID, Client ID, and Client secret, Cymph lists the subscriptions the app can access and, once a subscription is selected, the Log Analytics workspaces within it — so you can pick the Subscription and Workspace from a list rather than typing IDs.

​
App registration setup

  1. In Entra ID → App registrations, create (or reuse) an app registration.
  2. Under Certificates & secrets, create a client secret and copy its value — this is the Client secret field above.
  3. Note the Application (client) ID and Directory (tenant) ID from the app’s Overview page.
No Microsoft Graph API permissions are required for this connector.

​
Permissions

Grant the app’s service principal the Reader role, at subscription scope (or at least on the resource group and Log Analytics workspace that host Sentinel):
  • Reader covers everything Cymph needs: listing subscriptions and workspaces, checking the Sentinel onboarding state, and reading analytics rules.
Alternatively, you can assign Microsoft Sentinel Reader on the workspace for the Sentinel-specific reads, but Reader at subscription scope is the simplest option because it also lets Cymph enumerate the subscription and workspace during setup.
To assign the role: open the target subscription → Access control (IAM) → Add role assignment → select Reader → assign it to your app registration’s service principal.

​
What Cymph reads

​
Testing the connection

​
Limitations

Sentinel is a detection source — playbooks cannot be deployed to it.