sentinel

Azure Sentinel

stoQ plugin that sends results to Azure Sentinel.

Plugin Classes

• Connector

Prerequisites

• Obtain Azure Log Analytics Workspace ID and Key. Directions for obtaining the keys can be found here

Configuration

All options below may be set by:

• plugin configuration file
• stoq command
• Stoq class

Required

• workspaceid [str]: ClientID/ID for the Log Analytics Workspace string

• workspacekey [str]: Key/Secret for the Log Analytics Workspace string. The primary or secondary shared key may be used.

• logtype [str]: This field denote the Log Analytics table that the log will send to. Log analytics will automatically append _CL to this value.

Defaults to stoQ.