> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-bp-2395-ms-sentinel.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Integrate BloodHound Enterprise with Microsoft Sentinel
> Install, configure, and verify the Microsoft Sentinel integration for BloodHound Enterprise.
The Microsoft Sentinel integration for BloodHound Enterprise enables security teams to ingest attack path data, audit logs, posture trends, and Tier Zero asset exposure into Microsoft Sentinel for centralized monitoring, investigation, and response.
It's available as a data connector that can be deployed to your Azure environment, with pre-built workbooks (dashboards) and analytics rules to visualize and act on the data.
## Roles and permissions
To successfully deploy and use the Microsoft Sentinel integration, different Azure roles and permissions are required for various personas involved in the process.
The following table outlines the key roles, their responsibilities, and the required permissions for each role:
| Role | Responsibilities | Required permissions |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Installer** | - Deploy resources for the Microsoft Sentinel solution resources from the Azure Marketplace
| - Subscription Owner on the target subscription.
|
| **Admin** | - Manage data connectors, including enable/disable actions and authentication settings
- Maintain and troubleshoot the integration, including parameters, playbooks, workbooks, and analytics rules
| - Microsoft Sentinel Contributor on the Log Analytics workspace
- Log Analytics Contributor to manage queries, tables, and saved searches
- Resource Group Contributor on the target resource group
*Optional:* - User Access Administrator to assign RBAC roles when needed
- Contributor for broader management of underlying Azure resources
|
| **User** | - Use the deployed solution in daily operations
- View dashboards, alerts, incidents, and workbooks
| - Microsoft Sentinel Reader for view-only access to incidents and workbooks
- Log Analytics Reader for read-only access to logs and query results
- Microsoft Sentinel Responder if the user needs to update incident status, assign incidents, or run playbooks
|
## Prerequisites
Before you begin the installation and configuration process, ensure the following prerequisites are met:
* Active Azure subscription with permissions to deploy resources
* Microsoft Sentinel workspace (Log Analytics Workspace) in a target resource group
* BloodHound Enterprise tenant
* BloodHound Enterprise [non-personal API key/ID pair](/integrations/bloodhound-api/working-with-api#create-a-non-personal-api-key%2Fid-pair)
* Microsoft Entra ID application with the **Monitoring Metrics Publisher** role on the target resource group
## Configure the integration
Follow the steps below to deploy and configure the Microsoft Sentinel integration for BloodHound Enterprise. This process involves deploying Azure resources, configuring authentication, and setting up data ingestion.
Create a Log Analytics Workspace to store the data ingested from BloodHound Enterprise. This workspace will be connected to Microsoft Sentinel for monitoring and analysis.
1. Log in to the [Azure Portal](https://portal.azure.com/) with an account that has the necessary permissions for Microsoft Sentinel and Log Analytics Workspace configurations.
2. Navigate to the Log Analytics Workspace and click **Create**.
3. Select subscription and resource group, then enter a workspace name.
4. Click **Review + create**.
5. Add the Log Analytics Workspace in Sentinel:
1. Navigate to Sentinel.
2. Click **Create.**
3. Select the newly created Log Analytics Workspace.
4. Click **Add**.
Register a Microsoft Entra ID application to authenticate the data connector with Microsoft Sentinel. This application will be granted the necessary permissions to publish data to Sentinel.
1. Open [Microsoft Entra ID](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview).
2. Go to **App registrations** > **New registration**.
3. Enter an app name and choose **Accounts in this organizational directory only**. No redirect URI is necessary.
4. Click **Register**.
5. Copy the **Application (client) ID** and **Directory (tenant) ID**. You'll need these later.
6. Under **Certificates & secrets**, create a client secret and save its value immediately. It will not be shown again.
Assign the **Monitoring Metrics Publisher** role to the Microsoft Entra ID application on your resource group:
1. Open your resource group.
2. Go to **Access control (IAM)** > **Add role assignment**.
3. Assign **Monitoring Metrics Publisher** to the Entra application.
4. Select a user, group, or service principal to assign access to, then click **Select members**.
5. Select the application that you created, then click **Select**.
6. Click **Review + Assign**.
Before starting the deployment, go to the Log Analytics Workspace you created and note the name and location of the workspace. You will need this during deployment.
1. Click the following link to open a preloaded ARM template in the Azure Portal: [Deploy to Azure](https://portal.azure.com/%23create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fmetron-labs%2FAzure-Sentinel%2Fbloodhound%2FSolutions%2FBloodHound%2520Enterprise%2FPackage%2FmainTemplate.json).
2. Confirm the template opens on the **Custom deployment** page.
Fill in the deployment parameters for the workbook and analytics rules template using the information from previous steps and your environment.
1. Select the target subscription and resource group, then enter deployment parameters such as workspace name and workspace location.
2. Click **Review + create**.
3. Click **Create** to deploy the workbook and data connector resources.
Verify the workbook and analytics rules deployment before deploying the data connector template:
1. In the Azure Portal, open **Microsoft Sentinel** and select the workspace where you deployed the template.
2. Go to **Workbooks** under **Threat management**.
3. If prompted to continue in Microsoft Defender, select the link to open **Microsoft Defender portal**.
4. If multiple Sentinel workspaces are available, select the integration workspace from the workspace selector in the top-right corner.
5. In **Workbooks**, open the **Templates** tab and verify the BloodHound workbook templates are available.
6. Go to **Configuration** > **Analytics** > **Rule templates** and verify the BloodHound analytics rules are available.
7. Go to **Configuration** > **Data connectors** and verify the **BloodHound Data Connector** is listed and connected.
After deploying the workbook and analytics rules template, configure the data connector with your BloodHound Enterprise API credentials and settings.
1. Log in to the Azure Portal with an account that has the **Owner** role on the resource group.
2. Click the following link to open a preloaded ARM template in the Azure Portal: [Deploy to Azure](https://portal.azure.com/%23create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fmetron-labs%2FAzure-Sentinel%2Fbloodhound%2FSolutions%2FBloodHound%2520Enterprise%2FData%2520Connectors%2Fazuredeploy_BloodHoundEnterprise_FunctionApp.json).
3. Confirm the template opens on the **Custom deployment** page.
Fill in the deployment parameters:
| Parameter Name | Description |
| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Subscription | The Azure subscription to deploy the resources to. |
| Resource Group | The name of the resource group where the resources will be deployed. |
| Function App Name | The name of the Azure Function App. This must be unique across Azure, since each instance requires its own Function App (for example, BloodHoundEnterprise-Maple). |
| Log Analytics Workspace Name | The name of the existing Log Analytics Workspace where you want to create a Data Collection Endpoint (DCE) and Data Collection Rule (DCR) for custom tables. |
| Bloodhound Tenant Domain | The URL for the BloodHound Enterprise tenant domain. |
| Bloodhound Token ID Secret Value | The value for the **BloodHound token ID**. This value will be stored in an Azure Key Vault secret. |
| Bloodhound Token Key Secret Value | The value for the **BloodHound token key**. This value will be stored in an Azure Key Vault secret. |
| Microsoft Entra Id Application App Id | The unique identifier for the Microsoft Entra ID application. This ID, also known as the **Client ID**, is used to authenticate your application to the Microsoft identity platform. |
| Microsoft Entra ID Application App Secret | A confidential secret generated for your Microsoft Entra ID application. This secret, also known as the **Client Secret**, is used along with the App ID to prove the application's identity when requesting an access token. |
| Lookup Days | Specifies the number of days in the past for which the system should fetch data. A higher value means more historical data will be retrieved, which increases the time and compute resources required during the first iteration when setting up the system. This parameter sets the default lookback period when no previous timestamp is available. |
| Selected Bloodhound Environments | The selected BloodHound environments from which you want to fetch data. These should be provided as comma-separated values (e.g., Ghost.Corp, Phantom.Corp). The default value is **All**. |
| Selected Finding Types | The selected Finding Types from which you want to fetch data. These should be provided as comma-separated values (e.g., T0MarkSensitive, T0GenericAll). The default value is **All**. |
1. Select the target subscription and resource group, then enter deployment parameters such as workspace name and workspace location.
2. Click **Review + create**.
3. Click **Create** to deploy the workbook and data connector resources.
The ARM template will deploy the necessary Azure resources for the data connector, but you will also need to deploy the Azure Function code that fetches data from BloodHound Enterprise and ingests it into Microsoft Sentinel.
1. Download the `BloodHoundAzureFunction.zip` archive from the [GitHub repository](https://github.com/metron-labs/Azure-Sentinel/blob/bloodhound/Solutions/BloodHound%20Enterprise/Data%20Connectors/BloodHoundDataConnector/BloodHoundAzureFunction.zip?raw=true).
2. Open your Function App in Azure Portal.
3. In the left menu, select **Deployment Center** under the **Deployment** section.
You will see multiple options for deployment, including:
* **GitHub**: Connect your GitHub repository for continuous deployment.
* **Azure Repos**: Connect your Azure DevOps repository for continuous deployment.
* **Publish files**: Manually upload your function code for one-time deployment.
4. Select **Publish files**, select the downloaded `BloodHoundAzureFunction.zip` archive, and click **Save**.
After deployment, you should see the function code in the **Functions** section of your Function App.
After deploying the Azure Function code, manually run each function to verify that the functions are running correctly and able to fetch data from BloodHound Enterprise and push it into the custom tables in your Log Analytics Workspace.
1. Navigate to the **Overview** page of your Function App and select one of the deployed functions.
2. Click the **Code + Test** tab.
3. Click **Test/Run**.
4. Click **Run** to execute the function.
5. Monitor the execution logs to confirm that the function is running successfully and fetching data from BloodHound Enterprise.
You should see log entries indicating successful execution and data retrieval for each finding type.
```log theme={null}
2025-10-31T08:57:55Z [Information] Collecting asset details for finding type: AzureT0MGGrantAppRoles
2025-10-31T08:57:55Z [Information] Making GET request to https://.bloodhoundenterprise.io/api/v2/assets/findings/AzureT0MGGrantAppRoles/title.md
2025-10-31T08:57:55Z [Information] Response status code: 200
2025-10-31T08:57:56Z [Information] Making GET request to https://.bloodhoundenterprise.io/api/v2/assets/findings/AzureT0MGGrantAppRoles/short_description.md
2025-10-31T08:57:56Z [Information] Response status code: 200
2025-10-31T08:57:56Z [Information] Making GET request to https://.bloodhoundenterprise.io/api/v2/assets/findings/AzureT0MGGrantAppRoles/short_remediation.md
2025-10-31T08:57:57Z [Information] Response status code: 200
2025-10-31T08:57:57Z [Information] Making GET request to https://.bloodhoundenterprise.io/api/v2/assets/findings/AzureT0MGGrantAppRoles/long_remediation.md
2025-10-31T08:57:57Z [Information] Response status code: 200
```
6. Repeat this one-time manual process for each deployed function to ensure all functions are working correctly.
## Validate the integration
Complete verification before operational use.
1. In Azure Portal, open **Function App** and confirm your deployed app exists and all BloodHound functions are listed.
2. Open **Key Vault** and confirm the connector vault exists and includes the expected secrets.
3. Open **Data Collection Endpoints** and confirm the BloodHound endpoint exists.
4. Open **Data Collection Rules** and confirm the BloodHound rules exist.
5. Open your Log Analytics workspace and confirm these custom tables exist:
* `BHEAttackPathsData_CL`
* `BHEAttackPathsTimelineData_CL`
* `BHEAuditLogsData_CL`
* `BHEFindingTrendsData_CL`
* `BHEPostureHistoryData_CL`
* `BHETierZeroAssetsData_CL`
Complete these steps to start your Azure Function App and begin ingesting BloodHound Enterprise data into custom tables.
1. Open your **Function App** and start it from **Overview** if it is stopped.
2. Open your Log Analytics workspace and click **Logs**.
3. Verify that you can see custom logs.
1. In Microsoft Sentinel, go to **Workbooks**. You must save each workbook before editing or operational use.
2. To save each workbook, double-click the workbook, then click **Save** in the modal that displays.
3. Open each workbook to confirm it loads data correctly. If you see errors, review the function execution logs and ensure the data connector is ingesting data into the custom tables.
1. In the Sentinel workspace, navigate to **Configuration** > **Analytics** > **Rule templates**.
2. To generate incidents, create and save each **Analytics rule**. Select any rule to open the right-side panel, then click **Create rule**.
3. Click **Next: Set rule logic** and keep the default values.
4. Click **Next: Incident settings** and keep the default values.
5. Click **Next: Automated response** and keep the default values.
6. Click **Next: Review + Create** and keep the default values.
7. Click **Save**.
8. Repeat this process for each **Analytics rule**. Incidents are generated only after the rules are created and saved.
9. To check incidents after rules are created, navigate to **Investigation & Responses** > **Incidents & Alerts** > **Incidents**.
## Next steps
Explore the pre-built workbooks to [visualize](/integrations/microsoft/sentinel/use) BloodHound Enterprise data and use the analytics rules to generate incidents for findings.