Britive Data Connector for Microsoft Sentinel
What’s New
Britive now ships a data connector for Microsoft Sentinel. Deploy one ARM template into your Log Analytics workspace, point it at your Britive tenant, and every checkout, approval, authentication, and policy change flows into Sentinel on its own — no scheduled export job to build or babysit.
Sentinel polls the Britive Audit Log API every five minutes. Measured latency from an event happening in Britive to it being queryable is about four minutes.
What You Get
The template deploys the whole set, not just the ingestion path:
BritiveAuditLogs_CL— a dedicated table withTimeGeneratedholding the time the event happened in Britive, not the time it was ingested.- Parsers — the
BritiveAuditLogsfunction, so queries read as named fields instead of raw JSON. - Analytic rules — a starter detection set, deployed disabled so nothing pages your on-call before you have reviewed it.
- Hunting queries and a workbook — for investigation and at-a-glance access activity.
Beta. The connector is distributed directly by Britive rather than through the Sentinel Content Hub, and is versioned 0.9.x — request the package from Britive Customer Success. Connect it from the Azure CLI or Azure PowerShell; the connector page’s Connect button is affected by an open Microsoft defect. The deploy guide covers both paths.