Microsoft Sentinel Source Node
The Microsoft Sentinel Source node is not generally available in Fleak Data Workflow. The workflow builder offers it only to accounts where it has been enabled. For the connectors that are generally available, see Data Assets.
This page is retained for accounts where it is enabled.
Quick Reference
- Connection Profile: Select the Microsoft Sentinel connection profile.
- KQL Query: The Kusto Query Language (KQL) query to run against the workspace.
- Batch Size: Advanced Settings.
Configuration
Configuration keys below are relative to the node configuration. Use the field name in the panel when following instructions in the builder; required markers such as an asterisk are not part of the name.
| Field in the panel | Configuration key | Where to edit / when shown |
|---|---|---|
| Connection Profile | connectionProfileId | Select the Microsoft Sentinel connection profile |
| KQL Query | kqlQuery | Node panel — The Kusto Query Language (KQL) query to run against the workspace. Required: Yes. |
| Batch Size | batchSize | Advanced Settings — Number of rows emitted per batch while paging through the query results; it does not cap the total rows returned by the query. Must be at least 1. Default: 1000. Required: No. |
Overview
The Microsoft Sentinel Source node queries Azure Monitor (Log Analytics / Azure Sentinel) using KQL and emits each result row as an record. It enables security and observability workflows that consume log data from Azure workspaces, including threat detection pipelines built on Microsoft Sentinel.
Related Nodes
- Microsoft Sentinel Sink: Forward pipeline records to Azure Monitor Logs via the Ingestion API
- Elasticsearch Source: Query an Elasticsearch index and emit each hit as an record