Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Query → Run Query

AI-generated

Overview

This node allows users to run custom queries against a specified Microsoft Sentinel instance. It is useful for retrieving security insights, logs, and other data stored in Sentinel workspaces by executing Kusto Query Language (KQL) queries. For example, a security analyst can use this node to run a query that detects suspicious activities or aggregates alert data for further analysis.

Use Case Examples

  1. Run a query to fetch all security alerts generated in the last 24 hours from a Sentinel workspace.
  2. Execute a custom KQL query to analyze network traffic logs stored in Sentinel.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified either by selecting from a list, entering a path in the format {subscriptionId}/{resourceGroupName}/{workspaceName}, or providing a valid Azure Portal/Management URL.
Query The Kusto Query Language (KQL) query string to run against the Sentinel workspace.

Output

JSON

  • tables
    • * `columns` * - Columns metadata of the query result tables.
      * rows
      * `` - Rows of data returned by the query.

Dependencies

  • Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.

Troubleshooting

  • Ensure the Sentinel instance identifier is correctly formatted and accessible.
  • Verify that the OAuth2 credentials have sufficient permissions to query the Sentinel workspace.
  • Check the query syntax to ensure it is valid Kusto Query Language (KQL).
  • Common error messages may include authentication failures, invalid query syntax, or resource not found errors. Resolving these typically involves verifying credentials, correcting the query, or confirming the Sentinel instance details.

Links

Discussion