Configuring Avanan with Microsoft Sentinel
Avanan provides an out-of-the-box integration with Microsoft Sentinel. You can send Avanan events to Microsoft Sentinel for centralized monitoring, investigation, correlation, and reporting.
The integration uses the Azure Monitor Logs Ingestion API:
Avanan → Microsoft Entra authentication → Azure Logs Ingestion endpoint → Data Collection Rule → Custom Log Analytics table → Microsoft Sentinel
The Data Collection Rule (DCR) defines the expected event structure and routes incoming events to the appropriate custom table in the Log Analytics workspace. The DCR immutable ID, ingestion endpoint, and stream name identify where and how Avanan sends the events.
Required Resources
|
Resource |
Purpose |
Created by |
|---|---|---|
|
Azure resource group |
Contains and manages the integration resources |
Customer |
|
Log Analytics workspace |
Stores the Avanan security events |
Customer |
|
Microsoft Sentinel |
Provides SIEM analysis and investigation capabilities |
Customer |
|
Avanan solution |
Installs the Microsoft Sentinel integration content |
Content Hub installation |
|
Custom Log Analytics table |
Stores the Avanan events |
Content Hub installation |
|
Data Collection Rule |
Defines the event schema and destination table |
Content Hub installation |
|
Data Collection Endpoint |
Provides the ingestion URL |
Content Hub installation |
|
Microsoft Entra application |
Authenticates Avanan |
Customer |
|
Client secret |
Allows the application to authenticate |
Customer |
|
Azure role assignment |
Allows the application to send events through the DCR |
Customer |
If your organization already has a Microsoft Sentinel workspace, you can skip Steps 1 to 3 and install the solution in the existing workspace.
Required Permissions
The administrator must have the Azure Owner role at the subscription level and the Microsoft Entra Application Developer role or higher. If an existing resource group is used, the Azure Owner role can be scoped to that resource group.
On the Avanan side, the administrator must have permissions to configure SIEM integrations in Avanan.