Microsoft Sentinel Sink Node
Quick Reference
In Destination, choose Asset Type and Asset Name, then open Configure Pipeline Settings. The fields listed here are the complete set of editable inputs for this Destination type, subject to the stated visibility conditions.
- Asset Type: Choose a Data Asset; UI selection determines the sink type on Save.
- Asset Name: Choose a Data Asset; reference to the selected data asset.
- Batch Size: Configure Pipeline Settings.
- Time Generated Field: Configure Pipeline Settings.
This connector is named Microsoft Sentinel in the UI. The data asset owns Data Collection Endpoint, Immutable DCR ID, and Stream Name. In Data Assets → Asset Information → Edit, existing property inputs are labeled Immutable Dcr Id and Stream Name; update them and Save → Save Changes. The Data Collection Endpoint input is visible, but Save rejects a changed endpoint: create a replacement asset for another endpoint, select it in Asset Name, then Save. Directory (Tenant) ID, Application (Client) ID, and Client Secret belong to the Microsoft Sentinel Workspace connection profile in Settings → Connection Profiles. Tenant ID is not an alternative asset setting.
Configuration
Configuration keys below are relative to the node configuration. Use the field name in the panel when following instructions in the builder; required markers such as an asterisk are not part of the name.
Destination panel
Choose Asset Type and Asset Name first. Type-specific inputs appear in Configure Pipeline Settings after an asset is selected; an asset error can prevent that section from appearing. A missing or unavailable asset is a reference problem, not proof that the connector does not exist.
The fields listed here are the complete set of editable inputs for this Destination type, subject to the stated visibility conditions.
| Field in the panel | Configuration key | Where to edit / when shown |
|---|---|---|
| Asset Type | UI only; no separate config key | Choose a Data Asset; UI selection determines the sink type on Save |
| Asset Name | dataAssetId | Choose a Data Asset; reference to the selected data asset |
| Batch Size | batchSize | Configure Pipeline Settings; required to save Destination — Number of records bundled into a single ingestion API request. Default: 500. Required: Yes. |
| Time Generated Field | timeGeneratedField | Configure Pipeline Settings — The field in each record that represents the record timestamp forwarded to Azure Monitor. Records without it are stamped with the ingestion time. Default: TimeGenerated. Required: No. |
This connector is named Microsoft Sentinel in the UI. The data asset owns Data Collection Endpoint, Immutable DCR ID, and Stream Name. In Data Assets → Asset Information → Edit, existing property inputs are labeled Immutable Dcr Id and Stream Name; update them and Save → Save Changes. The Data Collection Endpoint input is visible, but Save rejects a changed endpoint: create a replacement asset for another endpoint, select it in Asset Name, then Save. Directory (Tenant) ID, Application (Client) ID, and Client Secret belong to the Microsoft Sentinel Workspace connection profile in Settings → Connection Profiles. Tenant ID is not an alternative asset setting.
Legacy panel
Use this section only when the workflow opens the legacy editor. Asset-managed connection values can be read-only; see Managing Data Assets for available edits and the replacement-asset flow.
| Field in the panel | Configuration key | Where to edit / when shown |
|---|---|---|
| Data Asset | dataAssetId | Select a Sentinel DCR stream asset |
| Batch Size | batchSize | Legacy panel — Number of records bundled into a single ingestion API request. Default: 500. Required: No. |
| Time Generated Field | timeGeneratedField | Legacy panel — The field in each record that represents the record timestamp forwarded to Azure Monitor. Records without it are stamped with the ingestion time. Default: TimeGenerated. Required: No. |
Overview
The Microsoft Sentinel Sink node forwards pipeline records to Azure Monitor Logs via the Azure Monitor Ingestion API (Data Collection Endpoint). It authenticates using an Azure Service Principal and routes records into a custom log table defined by a Data Collection Rule, making it suitable for centralising pipeline output in Azure Monitor or Microsoft Sentinel.
Related Nodes
- Microsoft Sentinel Source: Query Azure Monitor Log Analytics using KQL and emit each result row as an record
- Splunk HEC Sink: Forward pipeline records to Splunk via the HTTP Record Collector