Connecting Azure Sentinel API with elastic

Connecting Azure Sentinel API with elastic

Published: 19 nov 2025

Author: Roeland Braam

Updated: 17 jan

Main Article Content

When using Elastic as a single pane of glass for executing security monitoring, all other security products and cloud environments should be connected. This makes it easier for analysts to maintain an overview of alerts and perform incident triage.

Regarding Azure Sentinel, there is a supported Elastic integration for connecting to Azure Event Hub, which can be used to retrieve events from Sentinel. However, this integration comes with several challenges:

• It uses AQMP protocol for data transport and does not support AMQP over WebSocket
• Requires port 5671/TCP and 5672/TCP from agent to the Azure endpoint
• IP addresses of the Azure endpoint can and will change over time
• Requires a azure storage account for storing state/offset
• Requires an EventHub (extra costs)
• Requires configuration on Sentinel to forward events to Eventhub

These challenges often result in the connection becoming unavailable, which makes troubleshooting difficult. Several of our customers have experienced this repeatedly, causing Sentinel alerts to go unprocessed and creating a risk that attacks may go undetected.

The article proposes using the Azure REST API as an alternative method for retrieving Azure Sentinel alerts.

Using the Azure REST API has some advantages:

• Less complex, so easier troubleshooting
• Direct connection to Azure Sentinel using REST API, no special firewall changes required
• Can route trough a proxy server
• Uses client certificates for authentication so more secure
• Requires almost no configuration on the Azure side
• Can also be used for retrieving vulnerability information

The solution uses Node-RED to automate workflows and establish the connection between Sentinel REST API and Elastic.

Azure Configuration

The setup requires gathering specific information from the Azure Sentinel tenant including client private key, JWT KID, clientId, tenantId, scope, and workspaceId.

Commands provided for certificate configuration:

openssl x509 -in cert.pem -outform der | openssl dgst -sha1 -binary | base64 | tr '+/' '-_' | tr -d '='

awk 'NF {sub(/\r/, ""); printf "%s\\n",$0}' privatekey.pem

The Node-RED Flow

The article details 12 function nodes including inject nodes with tenant information, JWT token creation, token signing, payload preparation, and Elasticsearch ingestion.

Code samples are provided for:

• JWT token creation
• Token request generation
• SecurityAlert query retrieval
• SecurityIncident query retrieval
• Payload conversion
• Elasticsearch ingestion preparation
• Error handling for duplicate documents

The solution converts Azure Sentinel alerts and incidents into NDJSON format for bulk ingestion into Elasticsearch using an ingest pipeline.