SIEM
Microsoft Sentinel
TechWatchAlert security events in a table of your Log Analytics workspace, queryable in KQL.
What the connector does
Events go through the Azure Monitor Logs Ingestion API to a custom table in your Log Analytics workspace, with an Entra ID application that can only write through the intended data collection rule (DCR). The documentation provides the table and DCR template, and sample KQL queries.
What comes into TechWatchAlert
- Detected vulnerabilities, tier and status changes, reported exploitation, reopened cases and verified fixes
- Machines that became exposed or were fixed, compliance and external attack surface findings
- Optionally, the actions in your organization's audit log
- Columns ready for your analytics rules: CVE, CVSS, EPSS, KEV, decision tier, machine, project
Setup
- Create the TechWatchAlert_CL custom table and the data collection rule (DCR) from the documentation's template
- Register an Entra ID application, create a secret and give it the “Monitoring Metrics Publisher” role on the DCR
- In Organization settings › Security › SIEM, choose Microsoft Sentinel, enter the ingestion endpoint, the DCR immutable ID, the stream, the tenant, the application and the secret, then “Test and save”
In the same family
Syslog TLS (CEF or JSON)TechWatchAlert security events in your syslog collector, encrypted over TLS, in CEF or JSON.View connector →SplunkTechWatchAlert security events in Splunk through the HTTP Event Collector, ready to correlate.View connector →ElasticTechWatchAlert security events in an Elasticsearch data stream, with ECS fields.View connector →
Connectors
Plug in your tools in minutes
Start with a repository, a fleet or a scan report: your first targeted alerts arrive with the first sync.
Free plan, no credit card · hosted in France