How to authenticate to Sentinel destination

Log Goblin

Hello,

Currently experiencing an issue when trying to configure the authentication section of the sentinel destination.

Have been following the Cribl guides but it is not clear on what should be entered into the Login URL, OAuth Secret and Client ID.

I am guessing the Login URL can be found from the App Registration in Azure and clicking on Endpoints?

Client ID of the App Registration is not accepted in the Cribl UI.

Any suggestions?

Thanks :)

Tomer Shvueli

@Log Goblin

We only currently support Oauth authentication with Azure Sentinel, see details on how to set that up here: https://docs.cribl.io/stream/usecase-azure-workspace/