> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Sentinel

> Connect Microsoft Sentinel to Myrmex — hunt with KQL and triage incidents on demand.

import { Note, Steps, Step, CardGroup, Card } from '@mintlify/components';

Connect **Microsoft Sentinel** so Myrmex can query your Log Analytics workspace with **KQL**, triage incidents, and fold Sentinel's SIEM/SOAR signals into investigations. Myrmex operates Sentinel live over the Azure APIs after you grant admin consent — it runs searches and reads incidents in real time, on demand, with **no Collector required** and nothing stored on the Myrmex side.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Incident triage" icon="bell">
    List and review Sentinel incidents as you work them.
  </Card>

  <Card title="KQL hunting" icon="magnifying-glass">
    Run KQL queries against the Log Analytics workspace on demand.
  </Card>

  <Card title="Cross-stack context" icon="layer-group">
    Correlate Sentinel results with your other connected integrations.
  </Card>

  <Card title="Guided response" icon="wrench">
    Get recommended next steps for incidents, with approval for any action.
  </Card>
</CardGroup>

## Before You Start

Microsoft Sentinel connects from the cloud — **no Collector is required**. You'll need:

* An Azure subscription with a **Sentinel-enabled Log Analytics workspace**.
* Your **Tenant ID**, **Subscription ID**, **Resource Group**, and **Workspace Name**.
* An account that can grant admin consent and holds at least the **Microsoft Sentinel Reader** role on the workspace.

## Step 1 — Create the Credential in Azure

<Steps>
  <Step title="Gather workspace details">
    In the Azure portal, open your Sentinel workspace and note the **Subscription ID**, **Resource Group**, and **Workspace Name**. Get the **Tenant ID** from the Microsoft Entra admin center.
  </Step>

  <Step title="Confirm access">
    Ensure the identity has at least the **Microsoft Sentinel Reader** role on the workspace. Add a responder role only when you want Myrmex to act on incidents.
  </Step>

  <Step title="Grant consent during Connect">
    Myrmex uses a pre-registered application. When you add the integration you'll be redirected to Microsoft to review and grant the requested permissions (scope `https://management.azure.com/.default`).
  </Step>
</Steps>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Microsoft Sentinel**, then fill in:

| Field               | Description                                         |
| ------------------- | --------------------------------------------------- |
| **Tenant ID**       | Your Microsoft Entra directory (tenant) ID.         |
| **Subscription ID** | The Azure subscription that contains the workspace. |
| **Resource Group**  | The resource group of the Sentinel workspace.       |
| **Workspace Name**  | The Log Analytics workspace name Sentinel runs on.  |

<Note>
  When you connect, you're redirected to Microsoft to sign in and grant admin consent. The authentication method and the set of granted permissions are captured automatically during consent — you don't enter them by hand.
</Note>

## Connect

Click **Connect** and complete the Microsoft admin-consent prompt. Microsoft Sentinel then appears under **Environment → Integrations**, and you can start hunting and triaging incidents from the Workspace.

<Note>
  Prefer least privilege: **Sentinel Reader** covers hunting and triage, and you can add a responder role only when you want the agents to act on incidents.
</Note>