Microsoft Sentinel
Overview
The Britive data connector for Microsoft Sentinel forwards your Britive audit trail into a Log Analytics workspace, where it becomes queryable with KQL and usable by Sentinel detections, workbooks and incidents.
Sentinel polls the Britive Audit Log API on a schedule, using its built-in codeless connector service. There is no agent to install, no Azure Function or Logic App to host, and no compute for your team to run or pay for.
This article explains the pattern and what it puts in your workspace. To stand it up, see Deploy the Connector.
What the integration gives you:
- Every Britive audit event in a typed Sentinel table, queryable with KQL
- Two parsers, including an ASIM
AuditEventnormalization so Sentinel’s built-in content can use Britive data - Five analytic rules and four hunting queries covering privileged checkout, non-human identity activity, policy deletion and ingestion health
- A workbook for privileged-access activity, identity breakdown, geography and connector health
The connector is currently distributed as a versioned solution package that Britive Customer Success provides on request, rather than through the Sentinel Content Hub. The artifacts are the same either way.
How It Works
Sentinel authenticates to Britive with an API token, collects the most recent five minutes of audit events, and stores them as typed rows you can query.
graph LR
A["Britive tenant<br/>Audit Log API v2"] -->|"polled<br/>every 5 min"| B["Sentinel connector<br/>(Microsoft-operated)"]
B --> C["Data collection<br/>endpoint"]
C --> D["Data collection rule<br/>transform"]
D --> E["BritiveAuditLogs_CL<br/>typed table"]
E --> F["Parsers"]
F --> G["Analytic rules<br/>Hunting queries<br/>Workbook"]
| Stage | What happens |
|---|---|
| Poll | Every five minutes, Sentinel requests the audit events from the last five minutes, authenticating with your API token |
| Collect | Sentinel pages through the whole window, so nothing is left behind on a busy tenant |
| Transform | Each event is flattened into typed columns and its timestamp converted to UTC |
| Store | Rows land in the BritiveAuditLogs_CL table, with the retention you set at deployment |
| Query | Parsers deduplicate and enrich; rules, hunts and the workbook read the parser rather than the raw table |
Querying Britive Data
Build queries and detections on the BritiveAuditLogs parser rather than the raw table:
BritiveAuditLogs
| where EventType == "access.checkout"
| project TimeGenerated, ActorName, ProfileName, TargetApplication, Success
| sort by TimeGenerated descThe parser deduplicates, lifts ProfileName, Justification, AccessType, ResourceName and BrokerName out of the schemaless TargetAdditionalInfo bag, and adds EventCategory, IsNonHumanIdentity and IsImpersonated.
Two things to know if you query BritiveAuditLogs_CL directly:
Successis a boolean, not a status string. UseSuccess == falseto find failures — a filter written asResult != 'success'matches nothing.- Deduplicate on
EventKey.EventIdis always empty, because Britive does not issue a per-event identifier. The parser already handles this for you.
Requirements
| Requirement | Detail |
|---|---|
| Log Analytics workspace | Microsoft Sentinel must already be enabled on it |
| Azure RBAC | Contributor on the resource group holding the workspace |
| Britive tenant | On Audit Log API v2 |
| Britive credential | An API token for a dedicated service identity with audit log read permission |
You do not need Microsoft Entra ID application-registration rights, and you do not need Azure RBAC Owner or User Access Administrator. Contributor on the resource group is enough.
Where the credential lives
You create a Britive API token and enter it in your own Azure tenant, where Sentinel stores it as a protected value that is never returned on read. Britive receives no Azure credential, and nothing about this integration gives Britive access to your workspace.
What Ships With the Connector
| Component | What it is |
|---|---|
BritiveAuditLogs_CL | The custom table, with typed columns for actor, client, event, result and target |
| Data collection endpoint and rule | The ingestion path and the transform that flattens each record |
| Connector page | The Sentinel data connector UI where you enter your tenant URL and token |
BritiveAuditLogs | Primary parser — deduplicates, lifts common fields, adds derived columns |
ASimAuditEventBritive | ASIM AuditEvent normalization built on the primary parser |
| Five analytic rules | Non-human identity privileged checkout, repeated failed access, off-hours checkout, policy or profile deletion, and no-data-received ingestion health |
| Four hunting queries | Checkout without checkin, impersonated sessions, new geography for an identity, secret access outliers |
| Workbook | Privileged-access activity, checkouts by application, identity and non-human identity breakdown, geography, failures, control-plane changes, connector health |
Analytic rules deploy disabled. Review and enable the ones you want — see Recommended Alerts for the wider detection catalog.
Know Before You Deploy
| Behavior | What it means for you |
|---|---|
| No historical backfill | Ingestion begins from the moment you connect — the connector cannot reach back and load past events. Export from Britive directly if you need history |
| Latency is minutes, not seconds | Roughly 10 minutes end to end, 15 worst case: a five-minute poll cycle plus Log Analytics ingestion time. If you need sub-minute streaming, talk to Britive |
| Token expiry is silent | If the API token expires or is revoked, ingestion stops while the connector page still reports Connected. The BritiveNoAuditDataReceived rule catches this — enable it |
| Events can arrive twice | A retried poll can deliver the same event again. Deduplicate on EventKey, which the BritiveAuditLogs parser already does |
| Outages self-heal up to 7 days | Short interruptions recover on their own. A gap longer than seven days cannot be recovered by the connector |
| Audit records can carry sensitive values | Event detail includes employee email addresses and internal hostnames, and on some event types short-lived cloud credentials embedded in URLs. Anyone who can query the table can read them — scope workspace access accordingly |
Costs
The connector itself is free. You pay Microsoft’s standard Sentinel ingestion charges for the data.
If volume is a concern, high-frequency automation events can be dropped at ingestion time, before they are billed, with a one-line edit to the data collection rule’s transform:
| where EventType !in ('environment.scan', 'application.scan')No filter is applied by default, so you get the complete audit trail unless you choose to trim it.