Azure Sentinel

TapPass ships audit events to Azure Sentinel via the Log Analytics HTTP Data Collector API. Events land in a custom log table (TapPass_CL) you can query with KQL alongside everything else in your Sentinel workspace.

Setup

1. Get workspace credentials

Azure → Log Analytics workspace → Settings → Agents → Log Analytics agent instructions:

• Workspace ID
• Primary or secondary key (shared key)

2. Configure TapPass

The url is the workspace’s Data Collector endpoint (https://<workspace-id>.ods.opinsights.azure.com/api/logs?api-version=2016-04-01); auth_token is the shared key.

Via environment:

TAPPASS_SIEM_URL=https://<workspace-id>.ods.opinsights.azure.com/api/logs?api-version=2016-04-01
TAPPASS_SIEM_DESTINATION=azure_sentinel
TAPPASS_SIEM_AUTH_TOKEN=<shared-key>

Or via the settings API (PUT /api/settings/siem):

{
  "enabled": true,
  "destination": "azure_sentinel",
  "url": "https://<workspace-id>.ods.opinsights.azure.com/api/logs?api-version=2016-04-01",
  "auth_token": "<shared-key>",
  "format": "json",
  "severity_filter": "detection"
}

3. Validate

curl -X POST https://tappass.example.com/api/settings/siem/test \
  -H "Authorization: Bearer $ADMIN_KEY"

Wait ~2 minutes (ingestion delay). Query in Sentinel:

TapPass_CL
| where TimeGenerated > ago(10m)
| take 20

Analytic rules

Example: alert when more than 5 policy blocks hit a single agent in 5 minutes:

TapPass_CL
| summarize Events = count() by bin(TimeGenerated, 5m)
| where Events > 5

Turn this into a Sentinel analytic rule for automatic incident creation.

Retention

Use Sentinel’s standard table retention (default 30 days; up to 2 years). TapPass’s own audit trail retention is independent — it’s the durable record of truth; Sentinel is for investigation speed.