R
Raspberry rose Marmot
Hi Team,
Currently, Harness has no native connector to send audit logs to the Microsoft Sentinel SIEM platform. We would like Harness to send its logs directly to a Microsoft Sentinel Data Collection Endpoint (DCE) via HTTP, which will allow for security teams to monitor these logs.
Requirements:
  • Embed the tenant ID, application ID, app secret (from customer) in application code, so that Harness can obtain access token to POST logs to Microsoft Sentinel DCE.
Key benefits of CCF push:
  • Application-controlled data flow: Your application controls when and how to send data, enabling intelligent batching strategies and optimized network usage.
  • Real-time ingestion: Send data immediately as events happen, without waiting for polling intervals.
  • Simplified architecture: No need to maintain API endpoints for Sentinel to poll.
  • Secure authentication: Uses Microsoft Entra applications with OAuth 2.0 for secure data submission.
Kind Regards,