--- title: Azure Sentinel Integration (Legacy) slug: azure-sentinel-integration-legacy description: The Azure Sentinel integration (legacy) sends alerts directly to an Azure Sentinel workspace using a workspace ID and shared key. New setups should use the Sentinel integration instead. docTags: createdAt: 2023-10-10T20:03:19.152Z --- This implementation method is legacy. Please use the **Azure Sentinel Integration **tab for the latest instructions. You can send your Flare alerts directly to your Azure Sentinel instance. Here's how to configure Flare and receive data in your Sentinel Workspace. For detailed instructions, follow the storylane *demo* provided below. :::Iframe{iframeHeight="0" code="
"} ::: # Configuration You will need a Workspace with read/write permissions as well as Keys (created in Azure Key Vault) ::::WorkflowBlock :::WorkflowBlockItem Navigate to the **Settings **menu in the top-right corner, and then click **Integrations**. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/l_M0JvWz8LZrQWAjTeULN_settings-integrations-menu-small.png) ::: :::WorkflowBlockItem Click on **Configure**, and then select **Channel**. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/EWNAHrUqiE8JqjnFExpA2_configure-channel-small.png) ::: :::WorkflowBlockItem Enter a Name for the Channel. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/h2OSOLE_Wiq86PPHLEa_R_image.png) ::: :::WorkflowBlockItem Select **Azure** **Sentinel** as Type. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/BD-uB-ExL-XZFyGm63PhC_image.png) ::: :::WorkflowBlockItem Fill in the information from Azure ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/BkMDhaA2ZArhrCqEGlvm__image.png) **Workspace ID and Shared Key:** Go to Sentinel -> Settings -> Workspace Setting -> Agents Management. From there open the dropdown **Log Analytics agent instructions.** You will see your workspace ID and Primary key there. ::: :::WorkflowBlockItem Test Channel ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/rNkWR_YRRbDy5jWQUnEY3_image.png) Confirm the values are correct by using the **Test Channel** button. You should receive a test log inside your Workspace Log analytics within a minute. ::: :::WorkflowBlockItem Create Alert Channel ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/cUoKRsmlktyM5SgwfFzwP_image.png) ::: :::: # Expected Output You should by then receive all the data Flare sends directly in your Workspace's Log Analytics. Note that we will write in a table called **Firework\_CL**. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/9dcuWJ2SbUG8tpGtJ56u2_screenshot-at-2021-05-13-11-38-58.png) # Flare Solution We also have Workbooks that aggregate the data you received in various Dashboards and Playbooks that automate opening of incidents and sending of emails when leaked credentials (email/password) are found. You can create the Solution on Azure by [Clicking Here](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/GalleryItemDetailsBladeNopdl/product~/%7B%22displayName%22%3A%22Flare%20for%20Microsoft%20Sentinel%22%2C%22itemDisplayName%22%3A%22Flare%20for%20Microsoft%20Sentinel%22%2C%22id%22%3A%22flaresystmesinc1617114736428.flare-systems-firework-sentinel%22%2C%22bigId%22%3A%22DZH318Z09BBX%22%2C%22legacyId%22%3A%22flaresystmesinc1617114736428.flare-systems-firework-sentinel%22%2C%22offerId%22%3A%22flare-systems-firework-sentinel%22%2C%22publisherId%22%3A%22flaresystmesinc1617114736428%22%2C%22publisherDisplayName%22%3A%22Flare%20Systems%22%2C%22summary%22%3A%22The%20intuitive%20platform%20that%20monitors%20your%20digital%20footprint%20%26%20delivers%20actionable%20intelligence%22%2C%22longSummary%22%3A%22Flare%20identifies%20your%20company%E2%80%99s%20digital%20assets%20made%20publicly%20available%20due%20to%20human%20error%20or%20malicious%20attacks.%20%22%2C%22description%22%3A%22%3Cdiv%3E%3Cb%3EFlare%3C%2Fb%3E%20is%20the%20proactive%20digital%20footprint%20monitoring%20solution%20for%20organizations.%20Our%20AI-driven%20technology%20constantly%20scans%20the%20online%20world%2C%20including%20the%20dark%2C%20deep%20and%20clear%20web%2C%20to%20discover%20unknown%20events%2C%20automatically%20prioritize%20risks%20and%20deliver%20actionable%20intelligence%20you%20can%20use%20instantly%20to%20improve%20security.%3Cbr%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cbr%3E%3Cdiv%3E%3Ca%20href%3D%5C%22https%3A%2F%2Fsignup.flare.systems%2Ftrial%5C%22%3ERequest%20a%20Free%20Trial!%3C%2Fa%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cbr%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan%3E%3Cp%20dir%3D%5C%22ltr%5C%22%3E%3Cb%3EHow%20can%20Microsoft%20Sentinel%20accelerate%20Flare's%20capacity%20to%20detect%20vulnerabilities%3F%3C%2Fb%3E%3C%2Fp%3E%3Cul%3E%3Cli%3E%3Cspan%3EFast%20track%20analysis%20of%20trends%20in%20various%20dark%20web%20platforms%20by%20offering%20real-time%20analysis%20and%20raising%20alerts%20or%20open%20incidents%20when%20necessary.%20Out%20of%20the%20box%20analytics%20and%20automation%20rules%20can%20show%20you%20which%20platforms%20are%20worthy%20of%20your%20attention%2C%20and%20warn%20you%20if%20these%20change.%3C%2Fspan%3E%3C%2Fli%3E%3Cli%3E%3Cspan%3EAutomate%20incidents%20creation%20and%20flow%20to%20resolve%20them%2C%20such%20as%20email%20warnings%20to%20employees%20when%20their%20credentials%20are%20compromised%2C%20and%20closing%20of%20the%20incident%20when%20password%20has%20been%20changed.%3C%2Fspan%3E%3C%2Fli%3E%3Cli%3E%3Cspan%3EDirectly%20integrate%20your%20pre-existing%20systems%20and%20processes%20to%20Flare.%20Avoid%20having%20to%20integrate%20through%20API%20and%20save%20precious%20engineering%20time.%3C%2Fspan%3E%3C%2Fli%3E%3C%2Ful%3E%3C%2Fspan%3E%3C%2Fdiv%3E%22%2C%22isPrivate%22%3Afalse%2C%22hasPrivateOffer%22%3Afalse%2C%22isMacc%22%3Afalse%2C%22isPreview%22%3Afalse%2C%22isByol%22%3Afalse%2C%22isCSPEnabled%22%3Atrue%2C%22isCSPSelective%22%3Afalse%2C%22isThirdParty%22%3Atrue%2C%22isStopSell%22%3Afalse%2C%22isReseller%22%3Afalse%2C%22hasFreeTrials%22%3Afalse%2C%22marketingMaterial%22%3A%5B%5D%2C%22legalTermsUri%22%3A%22https%3A%2F%2Fquery.prod.cms.rt.microsoft.com%2Fcms%2Fapi%2Fam%2Fbinary%2FRE5bCxh%22%2C%22privacyPolicyUri%22%3A%22https%3A%2F%2Fflare.systems%2Fwp-content%2Fuploads%2F2019%2F12%2FPrivacy_Policy_FlareSystems.pdf%22%2C%22version%22%3A%22d339874f-813d-4cf2-a0df-476b936d275e%22%2C%22metadata%22%3A%7B%22leadGeneration%22%3A%7B%22productId%22%3Anull%7D%2C%22testDrive%22%3Anull%7D%2C%22categoryIds%22%3A%5B%22security%22%2C%22information-protection%22%2C%22azureCertified%22%2C%22fromPublishingPortal%22%2C%22multiResourceSolution%22%2C%22readonlytemplate%22%2C%22virtualMachine%22%2C%22virtualMachine-Arm%22%5D%2C%22screenshotUris%22%3A%5B%22https%3A%2F%2Fstore-images.s-microsoft.com%2Fimage%2Fapps.9709.9891123b-6670-46e3-a531-6a05435d2bfc.cb062e59-b5c4-4968-9e48-1ef4a640b8a1.bc4d543d-5232-4340-be64-e271e0019f41%22%2C%22https%3A%2F%2Fstore-images.s-microsoft.com%2Fimage%2Fapps.164.9891123b-6670-46e3-a531-6a05435d2bfc.cb062e59-b5c4-4968-9e48-1ef4a640b8a1.47d5c371-1f9f-46bf-ab2d-f8fb0789a996%22%2C%22https%3A%2F%2Fstore-images.s-microsoft.com%2Fimage%2Fapps.12454.9891123b-6670-46e3-a531-6a05435d2bfc.cb062e59-b5c4-4968-9e48-1ef4a640b8a1.7e3d341a-eacc-458d-b759-1697845281b2%22%5D%2C%22videos%22%3A%5B%5D%2C%22links%22%3A%5B%7B%22id%22%3A%22Website%22%2C%22displayName%22%3A%22Website%22%2C%22uri%22%3A%22https%3A%2F%2Fflare.systems%2Fpartners%2Ftechnology-partners%2Fmicrosoft-azure-sentinel-integrates-with-firework-platform%2F%22%7D%5D%2C%22filters%22%3A%5B%5D%2C%22plans%22%3A%5B%7B%22id%22%3A%220001%22%2C%22displayName%22%3A%22Flare%20for%20Microsoft%20Sentinel%22%2C%22summary%22%3A%22We%20help%20security%20teams%20visualize%20and%20manage%20external%20cyber%20risk.%22%2C%22description%22%3A%22%3Cdiv%3E%3Cb%3EFlare%3C%2Fb%3E%20is%20the%20proactive%20digital%20footprint%20monitoring%20solution%20for%20organizations.%20Our%20AI-driven%20technology%20constantly%20scans%20the%20online%20world%2C%20including%20the%20dark%2C%20deep%20and%20clear%20web%2C%20to%20discover%20unknown%20events%2C%20automatically%20prioritize%20risks%20and%20deliver%20actionable%20intelligence%20you%20can%20use%20instantly%20to%20improve%20security.%3Cbr%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cbr%3E%3Cdiv%3E%3Ca%20href%3D%5C%22https%3A%2F%2Fsignup.flare.systems%2Ftrial%5C%22%3ERequest%20a%20Free%20Trial!%3C%2Fa%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cbr%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cp%20dir%3D%5C%22ltr%5C%22%3E%3Cb%3EHow%20can%20Microsoft%20Sentinel%20accelerate%20Flare's%20capacity%20to%20detect%20vulnerabilities%3F%3C%2Fb%3E%3C%2Fp%3E%3Cul%3E%3Cli%3EFast%20track%20analysis%20of%20trends%20in%20various%20dark%20web%20platforms%20by%20offering%20real-time%20analysis%20and%20raising%20alerts%20or%20open%20incidents%20when%20necessary.%20Out%20of%20the%20box%20analytics%20and%20automation%20rules%20can%20show%20you%20which%20platforms%20are%20worthy%20of%20your%20attention%2C%20and%20warn%20you%20if%20these%20change.%3C%2Fli%3E%3Cli%3EAutomate%20incidents%20creation%20and%20flow%20to%20resolve%20them%2C%20such%20as%20email%20warnings%20to%20employees%20when%20their%20credentials%20are%20compromised%2C%20and%20closing%20of%20the%20incident%20when%20password%20has%20been%20changed.%3C%2Fli%3E%3Cli%3EDirectly%20integrate%20your%20pre-existing%20systems%20and%20processes%20to%20Flare.%20Avoid%20having%20to%20integrate%20through%20API%20and%20save%20precious%20engineering%20time.%3C%2Fli%3E%3C%2Ful%3E%3C%2Fdiv%3E%22%2C%22restrictedAudience%22%3A%7B%7D%2C%22skuId%22%3A%220001%22%2C%22planId%22%3A%22flare-systems-firework-sentinel-1%22%2C%22legacyPlanId%22%3A%22flaresystmesinc1617114736428.flare-systems-firework-sentinelflare-systems-firework-sentinel-1%22%2C%22keywords%22%3A%5B%5D%2C%22type%22%3A%22SolutionTemplate%22%2C%22leadGeneration%22%3A%7B%22productId%22%3A%22flaresystmesinc1617114736428.flare-systems-firework-sentinelflare-systems-firework-sentinel-1%22%7D%2C%22testDrive%22%3Anull%2C%22categoryIds%22%3A%5B%5D%2C%22conversionPaths%22%3A%5B%5D%2C%22metadata%22%3A%7B%7D%2C%22uiDefinitionUri%22%3A%22https%3A%2F%2Fcatalogartifact.azureedge.net%2Fpublicartifacts%2Fflaresystmesinc1617114736428.flare-systems-firework-sentinel-d339874f-813d-4cf2-a0df-476b936d275e-flare-systems-firework-sentinel-1%2FUiDefinition.json%22%2C%22artifacts%22%3A%5B%7B%22name%22%3A%22createuidefinition%22%2C%22uri%22%3A%22https%3A%2F%2Fcatalogartifact.azureedge.net%2Fpublicartifacts%2Fflaresystmesinc1617114736428.flare-systems-firework-sentinel-d339874f-813d-4cf2-a0df-476b936d275e-flare-systems-firework-sentinel-1%2FArtifacts%2FcreateUiDefinition.json%22%2C%22type%22%3A%22Custom%22%7D%2C%7B%22name%22%3A%22UiDefinition.json%22%2C%22uri%22%3A%22https%3A%2F%2Fcatalogartifact.azureedge.net%2Fpublicartifacts%2Fflaresystmesinc1617114736428.flare-systems-firework-sentinel-d339874f-813d-4cf2-a0df-476b936d275e-flare-systems-firework-sentinel-1%2FUiDefinition.json%22%2C%22type%22%3A%22Custom%22%7D%2C%7B%22name%22%3A%22DefaultTemplate%22%2C%22uri%22%3A%22https%3A%2F%2Fcatalogartifact.azureedge.net%2Fpublicartifacts%2Fflaresystmesinc1617114736428.flare-systems-firework-sentinel-d339874f-813d-4cf2-a0df-476b936d275e-flare-systems-firework-sentinel-1%2FArtifacts%2FmainTemplate.json%22%2C%22type%22%3A%22Template%22%7D%5D%2C%22isPrivate%22%3Afalse%2C%22isHidden%22%3Afalse%2C%22hasFreeTrials%22%3Afalse%2C%22isByol%22%3Afalse%2C%22isFree%22%3Afalse%2C%22isPayg%22%3Atrue%2C%22isStopSell%22%3Afalse%2C%22cspState%22%3A%22OptIn%22%2C%22isQuantifiable%22%3Afalse%2C%22displayRank%22%3A%222147483647%22%2C%22purchaseDurationDiscounts%22%3A%5B%5D%2C%22upns%22%3A%5B%5D%2C%22hasRI%22%3Afalse%2C%22pricingTypes%22%3A%5B%5D%2C%22stackType%22%3A%22ARM%22%7D%5D%2C%22selectedPlanId%22%3A%22flare-systems-firework-sentinel-1%22%2C%22iconFileUris%22%3A%7B%22wide%22%3A%22https%3A%2F%2Fstore-images.s-microsoft.com%2Fimage%2Fapps.40969.9891123b-6670-46e3-a531-6a05435d2bfc.8071c886-1657-4f6f-b639-2b17b0734c7d.4680abb2-5695-4190-8f7b-af599fca332c%22%2C%22medium%22%3A%22https%3A%2F%2Fstore-images.s-microsoft.com%2Fimage%2Fapps.20897.9891123b-6670-46e3-a531-6a05435d2bfc.cb062e59-b5c4-4968-9e48-1ef4a640b8a1.5b7ea39e-5745-40a4-b81f-99969f4847ea%22%2C%22small%22%3A%22https%3A%2F%2Fstore-images.s-microsoft.com%2Fimage%2Fapps.50543.9891123b-6670-46e3-a531-6a05435d2bfc.cb062e59-b5c4-4968-9e48-1ef4a640b8a1.da644231-7e2c-41a7-83b6-145c268562bb%22%2C%22large%22%3A%22https%3A%2F%2Fstore-images.s-microsoft.com%2Fimage%2Fapps.41574.9891123b-6670-46e3-a531-6a05435d2bfc.cb062e59-b5c4-4968-9e48-1ef4a640b8a1.144e8183-9ddc-46a8-9c6e-7a638ee89755%22%7D%2C%22itemType%22%3A%22Single%22%2C%22hasNoProducts%22%3Afalse%2C%22hasNoPlans%22%3Afalse%2C%22privateBadgeText%22%3Anull%2C%22createBladeType%22%3A1%2C%22offerType%22%3A%22AzureApplication%22%2C%22useEnterpriseContract%22%3Afalse%2C%22hasStandardContractAmendments%22%3Afalse%2C%22standardContractAmendmentsRevisionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22cspLegalTermsUri%22%3A%22https%3A%2F%2Fquery.prod.cms.rt.microsoft.com%2Fcms%2Fapi%2Fam%2Fbinary%2FRE5bCxh%22%2C%22supportUri%22%3A%22https%3A%2F%2Fflare.systems%2Fcompany%2Fcontact%2F%22%2C%22isMicrosoftProduct%22%3Atrue%2C%22productOwnershipSellingMotion%22%3A%223PPAgency%22%2C%22galleryItemAccess%22%3A0%2C%22privateSubscriptions%22%3A%5B%5D%2C%22isTenantPrivate%22%3Afalse%2C%22hasRIPlans%22%3Afalse%2C%22pricingTypes%22%3A%5B%5D%7D/id/flare-systems-firework-sentinel-1/resourceGroupId//resourceGroupLocation//dontDiscardJourney~/false/_provisioningContext~/%7B%22initialValues%22%3A%7B%22subscriptionIds%22%3A%5B%22b69d0658-2c18-4efc-a294-ebc32446a769%22%5D%2C%22resourceGroupNames%22%3A%5B%5D%2C%22locationNames%22%3A%5B%5D%7D%2C%22telemetryId%22%3A%22eedb12de-e582-4bbc-b088-c7b6615c617c%22%2C%22marketplaceItem%22%3A%7B%22categoryIds%22%3A%5B%5D%2C%22id%22%3A%22Microsoft.Portal%22%2C%22itemDisplayName%22%3A%22NoMarketplace%22%2C%22products%22%3A%5B%5D%2C%22version%22%3A%22%22%2C%22productsWithNoPricing%22%3A%5B%5D%2C%22publisherDisplayName%22%3A%22Microsoft.Portal%22%2C%22deploymentName%22%3A%22NoMarketplace%22%2C%22launchingContext%22%3A%7B%22telemetryId%22%3A%22eedb12de-e582-4bbc-b088-c7b6615c617c%22%2C%22source%22%3A%5B%5D%2C%22galleryItemId%22%3A%22%22%7D%2C%22deploymentTemplateFileUris%22%3A%7B%7D%2C%22uiMetadata%22%3Anull%7D%7D). # Related Articles :::CtaButton{label="Jira Integration" docId="KxvmCnotECpsBlK_YPofr" openInNewTab="true"} ::: :::CtaButton{label="Splunk Integration" docId="ca9Opdt4_IFgL1pu8HBSU" openInNewTab="true"} ::: :::CtaButton{label="Slack Integration" docId="kpbMB0w-L80be7nunpDrw" openInNewTab="true"} :::