> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Sentinel

> Read Sentinel analytics rules and map their MITRE ATT&CK techniques.

## What Cymph uses it for

Cymph connects to Microsoft Sentinel to read your analytics/detection rules and map their MITRE ATT\&CK techniques, so a preset's scope can be derived from what you actually detect. See [Manage presets](/how-tos/create-and-manage-presets) for the detection-based scope option.

All operations are **read-only** — Cymph never modifies rules, incidents, or workspace configuration.

Authentication uses an **Entra ID app registration** (client-credentials flow) against the Azure Resource Manager API. Access is therefore controlled by **Azure RBAC role assignments**.

## Requirements

| Field             | Description                                               |
| ----------------- | --------------------------------------------------------- |
| **Tenant ID**     | Your Entra ID (Azure AD) tenant ID                        |
| **Client ID**     | Application (client) ID of the app registration           |
| **Client secret** | A client secret generated for the app registration        |
| **Subscription**  | The Azure subscription containing your Sentinel workspace |
| **Workspace**     | The Log Analytics workspace that Sentinel is onboarded to |

After you enter the Tenant ID, Client ID, and Client secret, Cymph lists the subscriptions the app can access and, once a subscription is selected, the Log Analytics workspaces within it — so you can pick the Subscription and Workspace from a list rather than typing IDs.

## App registration setup

1. In **Entra ID → App registrations**, create (or reuse) an app registration.
2. Under **Certificates & secrets**, create a **client secret** and copy its value — this is the **Client secret** field above.
3. Note the **Application (client) ID** and **Directory (tenant) ID** from the app's Overview page.

No Microsoft Graph API permissions are required for this connector.

## Permissions

Grant the app's service principal the **Reader** role, at **subscription scope** (or at least on the resource group and Log Analytics workspace that host Sentinel):

* **Reader** covers everything Cymph needs: listing subscriptions and workspaces, checking the Sentinel onboarding state, and reading analytics rules.

<Tip>
  Alternatively, you can assign **Microsoft Sentinel Reader** on the workspace for the Sentinel-specific reads, but **Reader** at subscription scope is the simplest option because it also lets Cymph enumerate the subscription and workspace during setup.
</Tip>

To assign the role: open the target subscription → **Access control (IAM)** → **Add role assignment** → select **Reader** → assign it to your app registration's service principal.

## What Cymph reads

| Purpose                                 | Azure Resource Manager call                                                                       |
| --------------------------------------- | ------------------------------------------------------------------------------------------------- |
| List subscriptions (setup)              | `Microsoft.Resources/subscriptions`                                                               |
| List Log Analytics workspaces (setup)   | `Microsoft.OperationalInsights/workspaces`                                                        |
| Verify Sentinel is onboarded            | `Microsoft.SecurityInsights/onboardingStates`                                                     |
| Read analytics rules & their techniques | `Microsoft.SecurityInsights/alertRules`, `Microsoft.SecurityInsights/securityMLAnalyticsSettings` |

## Testing the connection

## Limitations

Sentinel is a detection source — playbooks cannot be deployed to it.