Microsoft Sentinel

​

Ingestion Endpoint

POST /v1/ingest/sentinel

​

Setting Up the Webhook

​

Option 1: Logic App (Recommended)

1. In the Azure portal, create a new Logic App
2. Add a trigger: When Azure Sentinel alert is triggered
3. Add an action: HTTP POST
   • URL: https://your-calseta-host/v1/ingest/sentinel
   • Headers: Authorization: Bearer cai_your_api_key
   • Body: Select the full alert JSON from the trigger output
4. Enable the Logic App

​

Option 2: Automation Rule

1. In Sentinel, go to Automation → Automation rules
2. Create a new rule with conditions matching the alerts you want to forward
3. Add an action: Run playbook (use a Logic App with the HTTP POST action above)

​

Payload Format

​

Severity Mapping

​

Indicator Extraction

• properties.entities — Sentinel’s parsed entities (IPs, accounts, hosts, file hashes)
• Alert description and custom fields via system normalized-field mappings
• Custom per-source field mappings you define against raw_payload

​

Webhook Signature Verification

​

Example Payload

{
  "properties": {
    "alertDisplayName": "Impossible Travel Activity",
    "severity": "High",
    "timeGenerated": "2025-01-15T10:28:00Z",
    "description": "Sign-in from two distant locations within 10 minutes",
    "tactics": ["InitialAccess"],
    "techniques": ["T1078"],
    "entities": [
      {
        "$id": "1",
        "Type": "ip",
        "Address": "185.220.101.47"
      },
      {
        "$id": "2",
        "Type": "account",
        "Name": "jsmith",
        "UPNSuffix": "company.com"
      }
    ]
  }
}

​

Rate Limits

​

API Reference