Microsoft Sentinel

1. Create a Data Collection Endpoint and custom table

1. In the Azure Portal, create a Data Collection Endpoint (DCE), and note its ingestion URL.
2. In your Log Analytics workspace, create a custom table (e.g. ThreatIntellixAlerts_CL) with this schema:

[
  { "name": "TimeGenerated", "type": "datetime" },
  { "name": "EventType", "type": "string" },
  { "name": "ioc", "type": "string" },
  { "name": "type", "type": "string" },
  { "name": "oldScore", "type": "int" },
  { "name": "newScore", "type": "int" },
  { "name": "verdict", "type": "string" }
]

Custom-table columns get a type suffix automatically (_s, _d); see the KQL example below.

2. Create a Data Collection Rule

Create a Data Collection Rule (DCR) associated with your DCE, with a stream mapping to the custom table above. Note the DCR's immutable ID and the stream name (e.g. Custom-ThreatIntellixAlerts_CL).

3. Register an app and grant it publish rights

1. Entra ID → App registrations → New registration. Create a client secret.
2. On the DCR, add a role assignment granting that app the Monitoring Metrics Publisher role.
3. Note the tenant ID, client ID, and client secret.

4. Configure the channel

In Settings → Alert channels, add a Microsoft Sentinel channel with the tenant ID, client ID, client secret, DCE endpoint, DCR immutable ID, and stream name from steps 1-3. A fresh access token is requested per alert sent (client-credentials flow); nothing is cached server-side.