Skip to content
Maskflare
Talk to usStart free trial
Menu

Microsoft Sentinel integration

Send Maskflare events to Microsoft Sentinel

Stream Maskflare events to Microsoft Sentinel through a signed HTTPS endpoint that writes to a Log Analytics table, with metadata only and no prompt content.
Start free trial Admin console
What it does
  • The same events as other destinations: blocked requests and files, policy and configuration changes, device and key notices, and a weekly digest
  • Request processed: one event per AI request, for threat hunting and workbooks you build yourself
  • A signed envelope with id, type, created_at and data, and a delivery log in the console
  • Custom headers on the endpoint, for example to authenticate to your receiver

Maskflare does not have a built-in Sentinel destination, and we don't publish a Sentinel data connector. What it has is a generic HTTPS endpoint destination that delivers signed JSON events, and that is the supported way to get events into Sentinel.

Sentinel stores data in a Log Analytics workspace, and the Azure Monitor Logs Ingestion API that writes to it needs a Microsoft Entra bearer token and a JSON array. Maskflare sends neither, so you put a small receiver in between, such as an Azure Function or a Logic App with an HTTP request trigger, that checks the signature and forwards the event.

What it does

Set up Microsoft Sentinel with Maskflare

There is no dedicated Sentinel connector. Maskflare posts signed JSON to an HTTPS endpoint you run, and that endpoint writes to your Sentinel workspace through the Azure Monitor Logs Ingestion API.

In Azure

  1. Create a custom table in the Log Analytics workspace that Sentinel uses, with its data collection rule, as described in the Logs Ingestion API documentation. Design the columns for the fields you want, such as type, created_at, organization, environment, provider and outcome.
  2. Build a receiver with a public HTTPS URL, for example an Azure Function or a Logic App with a request trigger. It should verify the Maskflare-Signature header, wrap the event in a JSON array, and call the Logs Ingestion API with a managed identity that has the Monitoring Metrics Publisher role on the data collection rule.
  3. Return a 2xx response quickly. Maskflare waits 10 seconds for an answer and retries failures.

In Maskflare

  1. Open Connections, then Integrations and select Add endpoint.
  2. Set Destination to HTTPS endpoint and URL to your receiver. Add Custom headers (one Name: value per line) if the receiver needs a key. Values are stored encrypted and never shown again.
  3. Under Events, tick what to send, for example Request blocked, Policy change decided, Block spike and Request processed. For Request processed, set Max events per minute.
  4. Select Add endpoint and copy the signing secret now: it is shown once. Store it where your receiver can read it.
  5. Select Send test event on the endpoint row, check the row appears in your table, and use Deliveries to see any error.
Python: verify a Maskflare delivery in your receiver
import hashlib, hmac, time

def verify(secret: str, signature_header: str, body: bytes, tolerance: int = 300) -> bool:
    # Maskflare-Signature: t=<unix timestamp>,v1=<hex hmac-sha256>
    parts = dict(item.split("=", 1) for item in signature_header.split(","))
    timestamp, signature = parts["t"], parts["v1"]
    if abs(time.time() - int(timestamp)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), timestamp.encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

What data is shared

Good to know

  • This is an HTTPS endpoint integration, not a managed connector. You build and run the receiver, and Maskflare does not ship a Sentinel solution, analytics rules or workbooks.
  • Maskflare accepts only https:// URLs that resolve to a public address. A Logic App request trigger URL or an Azure Function URL qualifies.
  • Deliveries are at least once with up to six attempts in all. Deduplicate on the event id.
  • Maskflare cannot post straight to the Logs Ingestion API, because that API needs an Entra access token that expires, and the custom headers on an endpoint are fixed values.

Vendor documentation

Frequently asked questions

Is there a Sentinel data connector?

No. Maskflare delivers signed JSON to an HTTPS endpoint, and you forward it to your Log Analytics workspace, for example with a Logic App or an Azure Function that calls the Logs Ingestion API.

Why not post directly to Azure Monitor?

The Logs Ingestion API needs an Entra bearer token and a JSON array body. Maskflare sends the event as a signed JSON object with fixed headers, so a small receiver is needed in between.

Do events contain prompts?

No. Events carry metadata and counts only, never prompts, responses or detected values. Request processed does include the device user's email address and the app key name.

Can we verify that an event came from Maskflare?

Yes. Each delivery has a Maskflare-Signature header with a timestamp and an HMAC-SHA256 of the body, made with the endpoint's signing secret.

Other siem and alerting integrations

SplunkSlackMicrosoft TeamsPagerDuty

All integrations

See it on your own data

Try Maskflare free.
Bring your hardest prompts.

28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.

Start free trial Talk to us