Torq

Create Microsoft Sentinel Step Integration in Torq

Create a new APP Registration in Entra ID.

Add the following required API permissions:

1. Log Analytics API: Data.Read
2. Microsoft Graph: SecurityIncident.ReadWrite.All or SecurityIncident.Read
3. Microsoft Graph: User.Read
 2.png

Copy the following information from App Registration into a secure location; you will need it when you create the integration in Torq:

1. Application (client) ID
2. Directory (tenant) ID
3. Client credentials


Copy the following from your Sentinel Deployment settings: 

1. Subscription ID
2. Workspace Name
3. Workspace ID 


Grant your app registration access to your Microsoft Sentinel subscription to be able to read and write incidents.

Navigate to your Azure Subscriptions and select the subscription where your Azure Sentinel workspaces are active.

Select <code>Microsoft Incident Responder</code> <a href="https://learn.microsoft.com/en-us/azure/sentinel/roles" rel="nofollow noopener noreferrer" target="_blank">role</a>.

In the members section, select the App Registration, which was previously created

Add the app as a member of the Microsoft Incident Responder role under Access Control (IAM)

1. Create a new APP Registration in Entra ID.

2. Add the following required API permissions:
 1. Log Analytics API: Data.Read
 2. Microsoft Graph: SecurityIncident.ReadWrite.All or SecurityIncident.Read
 3. Microsoft Graph: User.Read
 2.png
3. Copy the following information from App Registration into a secure location; you will need it when you create the integration in Torq:
 1. Application (client) ID
 2. Directory (tenant) ID
 3. Client credentials

4. Copy the following from your Sentinel Deployment settings: 
 1. Subscription ID
 2. Workspace Name
 3. Workspace ID 

5. Grant your app registration access to your Microsoft Sentinel subscription to be able to read and write incidents.
6. Navigate to your Azure Subscriptions and select the subscription where your Azure Sentinel workspaces are active. 

7. Select <code>Microsoft Incident Responder</code> <a href="https://learn.microsoft.com/en-us/azure/sentinel/roles" rel="nofollow noopener noreferrer" target="_blank">role</a>.

8. In the members section, select the App Registration, which was previously created

9. Add the app as a member of the Microsoft Incident Responder role under Access Control (IAM) 

10. Click Save.

Go to Build &gt; Integrations &gt; Steps &gt; Microsoft Sentinel, and click Add.

Give the integration a unique and meaningful name. 

Paste the Application Client ID from step 3a.

Paste the Application Client Secret from step 3c. 

1. Go to Build &gt; Integrations &gt; Steps &gt; Microsoft Sentinel, and click Add. 
2. Give the integration a unique and meaningful name. 
3. Paste the Tenant ID from step 3b.
4. Paste the Application Client ID from step 3a.
5. Paste the Application Client Secret from step 3c. 
6. Paste the Subscription ID from step 4a.
7. Click Add.

Learn to create a Microsoft Sentinel Step integration in Torq, including APP registration in Entra ID (formerly Azure AD)