---
title: Sentinel Integration
slug: sentinel-integration
description: The Sentinel integration sends alert data into Microsoft Sentinel through a codeless connector in the content hub. It includes prebuilt analytic rules and workbooks for visualizing risk scores and leaked credentials.
docTags:
createdAt: 2026-02-25T15:38:22.310Z
---
This guide replaces the previous *Azure Sentinel Integration*. The new **Codeless Connector Framework (CCF)** integration offers a streamlined, "click-to-deploy" experience available directly within the **Microsoft Sentinel Content Hub**. This update significantly reduces the manual configuration required to ingest Flare events into Azure.
The CCF enables partners and developers to create robust, custom connectors for seamless data ingestion into Microsoft Sentinel.
Please note, if you currently are using the Flare connector this will create a second table within Sentinel. It is recommended to sunset the older connector and migrate to this one.
## Azure Sentinel Setup
Install Flare via the Content Hub
The first step is to install the Flare Solution and deploy the Codeless Connector. This connector automatically receives Flare events and transforms them into queryable logs within Sentinel.
1. Navigate to **Microsoft Sentinel > Content management > Content Hub**.
2. Search for “Flare” in the search bar.
3. Select the Flare solution and click **Install**. Deployment typically takes a few seconds.
4. Once installed, click **Manage**.
5. Select **Flare Push Connector** and click **Open connector page**
## Deploy Custom Resources
1. On the connector page, select **Deploy custom resources** and accept the confirmation prompt.
:::hint{type="info"}
This will automatically create Azure resources, including an **Application** **Secret** valid for 731 days. This is a default value which we do not control in the Connector's form. See the Secrets Management section below for more details on how to manage this secret.
:::
2. Once the deployment is complete, several configuration fields will automatically be populated. **Keep this page open**, as you will need these values to link Flare to Azure Sentinel.
## Flare Setup
**Setup the Integration Channel**
1. In the Flare platform, navigate to **Configure > Integrations** and select **Create Channel**.
2. In the modal, select **Azure Sentinel** from the dropdown menu.
3. Copy the values from the Sentinel Connector Page into into the corresponding fields.
## Verify and Finalize
1. Press **Test Channel** to verify the connection.
2. Once the test is successful, click **Create Channel** to finalize the integration.
## Secrets Management
When the Flare Connector is deployed using the one-click deployment button, Azure automatically creates a Data Collection Endpoint (DCE) along with an App Registration and a client secret valid for 731 days. If a shorter-lived secret is required, revoke the existing secret and create a new one by following the steps below.
In Azure, navigate to the **App Registrations** page, then select the relevant App Registration. To quickly locate it, filter by the Application ID (Entra Client ID).
Under Manage > Credentials & secrets, your existing secrets are listed.
### Revoking a secret
Press the trash icon next to the secret you want to remove. This immediately disables the integration - any request from Flare will be rejected until a new secret is configured.
### Creating a secret
Click New client secret to open the creation form, where you can configure the secret's expiration date.
Once the new secret is created, make sure to update it in Flare and verify the integration is working using the Test Channel button.
## Flare Solution Features
The Flare Solution includes pre-packaged **Analytic Rules** and **Workbooks** to help you monitor and visualize your data. They must be manually deployed through Azure Sentinel.
**Note on Initial Setup**: Analytic rules and workbooks will likely display error messages until the connector receives its first set of data. These components will remain inactive on fresh instances until data ingestion begins.
### Analytic Rules
Analytic Rules enable automated alerting based on **Kusto Query Language (KQL)**. These rules help you identify specific security threats as they appear in your logs. They can be configured from **Azure Sentinel > Configuration > Analytics > Rules templates**.
### Workbooks
Workbooks provide interactive data visualizations for Flare events directly within the Sentinel dashboard. They are located in **Azure Sentinel > Threat management > Workbooks > Templates**.
Flare includes three basic workbooks: Firework Logs by risk score, Sources of all documents collected and Total Leaked Credentials received.
- **Firework Logs by Risk Score**: This chart displays log activity sourced from Flare over the past 30 days, broken down by risk score level. Each line represents a distinct risk score category.
- **Sources of All Document Collected**: This section displays the origin of all threat intelligence documents ingested over the past 30 days, broken down by source.
- **Total Leaked Credentials Received**: This section is **deprecated** and will be removed in the next release. It displays a time series of credential leak events.
### Flare Solution Schema
To understand how Flare data is structured or to build your own custom queries, you can inspect the data model using the following KQL command in the Logs interface accessible under **Azure Sentinel > Logs**
:::BlockQuote
FireworkV2\_CL
\| getschema
:::
For reference, here is the latest schema:
| **Column Name** | **Type** | **Example** |
| -------------------- | ----------------------- | -------------------------------------------------------------------------- |
| TimeGenerated | Datetime (UTC) | 2026-02-17T15:06:35.7076596Z |
| EventVendor | string | Flare |
| EventProduct | string | Firework |
| EventSchemaVersion | string | 0.1 |
| EventSeverity | string | Informational |
| EventOriginalUid | string | domain/driller\_dnstwist/clare.io |
| EventOriginalType | string | domain |
| RiskScore | int | 1 |
| Url | Optional string | https\://app.flare.io/events/test-social\_media\_account |
| timestamp | Optional string | 2026-01-20T20:07:44.0633340+00:00 |
| timestamp\_formatted | Optional string | |
| first\_crawled\_at | Optional string | 2026-01-20T20:07:44.0633340+00:00 |
| materialized\_at | Optional string | 2026-01-20T20:13:20.7334390+00:00
|
| url | Optional string | |
| event\_title | Optional string | clare.io |
| event\_type | Optional string | domain |
| source | Optional string | driller\_dnstwist |
| source\_name | Optional string | dnstwist |
| id | Optional string | clare.io |
| keyword | Optional string | |
| category\_name | Optional string | domain |
| content\_preview | Optional dynamic object | Domain clare.io |
| content | Optional string | |
| alert\_content | Optional string | |
| highlights | Optional dynamic object | \{"identifier\_domain":\["\flare.io\"]} |
| risk | Optional dynamic object | \{"score":1,"unit\_score":0.1,"risk\_score":1,"service\_score":1} |
| tags | Optional dynamic object | \[] |
| related | Optional dynamic object | \[] |
| user\_risk\_score | Optional int | |
| user\_notes | Optional string | |
| data | Optional dynamic object | \{"username":"@fake\_example\_corp","platform":"Twitter","followers":1500} |
| uid | Optional string | domain/driller\_dnstwist/clare.io |
| external\_url | Optional string | |
| | | \[\{"id":14771403,"type":"domain","name":"flare.io","group"\:null}] |
| sort | Optional string | WzE3Njg5NDAwMDA3MzMsICJkb21haW4vZHJpbGxlcl9kbnN0d2lzdC9jbGFyZS5pbyJd |
| Identifiers | Optional Dynamic Object | |
| asset\_uuids | Optional dynamic object | |
| code | Optional dynamic object | |
| author\_id | Optional string | |
| project\_name | Optional string | |
| sha | Optional string | |
| actor | Optional string | WWW |
| victim\_name | Optional string | |
| TenantId | Optional string | ea21e035-057f-483d-aad9-f436617a24a6 |
| Type | Optional string | FireworkV2\_CL |
| \_ResourceId | Optional string | |