Azure Monitor Sink Node
Quick Reference
Microsoft Sentinel Table The Sentinel Table data asset to ingest into. It carries the Data Collection Endpoint, the immutable Data Collection Rule (DCR) ID and the target stream name; the Microsoft Sentinel Workspace connection profile behind it carries the tenant ID and the Service Principal credential used to obtain an Entra ID token for ingestion.
Time Generated Field
The field in each record that represents the record timestamp sent to Azure Monitor. Records without it are stamped with the ingestion time.
ex: TimeGenerated
Batch Size
Number of records sent per ingestion request.
ex: 500
Overview
The Azure Monitor Sink node forwards pipeline records to Azure Monitor Logs via the Azure Monitor Ingestion API (Data Collection Endpoint). It authenticates using an Azure Service Principal and routes records into a custom log table defined by a Data Collection Rule, making it suitable for centralising pipeline output in Azure Monitor or Microsoft Sentinel.
Configuration
| Field | Description | Required | Default |
|---|---|---|---|
| Microsoft Sentinel Table | Select or create a Sentinel Table data asset. It supplies the Data Collection Endpoint, the immutable DCR ID and the stream name, and the Microsoft Sentinel Workspace connection profile behind it supplies the tenant ID and the Service Principal credential used to obtain an Entra ID token for ingestion. | Yes | — |
| Time Generated Field | The field in each record that represents the record timestamp forwarded to Azure Monitor. Records without it are stamped with the ingestion time. | No | TimeGenerated |
| Batch Size | Number of records bundled into a single ingestion API request. | No | 500 |
Related Nodes
- Azure Monitor Source: Query Azure Monitor Log Analytics using KQL and emit each result row as an record
- Splunk HEC Sink: Forward pipeline records to Splunk via the HTTP Record Collector