Azure Sentinel Query

Azure Sentinel Query

Certified

Query Microsoft Sentinel logs with KQL

Queries the Log Analytics workspace backing Sentinel. Returns the primary result table with column metadata. Partial query errors fail the task. The Azure SDK may materialize the response before results are stored.

yaml
type: io.kestra.plugin.azure.sentinel.Query

Store recent security alerts

yaml
id: sentinel_query
namespace: company.team
tasks:
  - id: query
    type: io.kestra.plugin.azure.sentinel.Query
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    clientSecret: "{{ secret('AZURE_CLIENT_SECRET') }}"
    workspaceId: "{{ secret('AZURE_LOG_ANALYTICS_WORKSPACE_ID') }}"
    query: SecurityAlert | take 100
    timespan: P1D
    serverTimeout: PT3M
    fetchType: STORE
Properties

KQL query

Kusto Query Language expression executed against the workspace.

Azure AD tenant ID (GUID)

Log Analytics workspace ID

The workspace customer ID (GUID), not its ARM resource ID or workspace name.

Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.

Definitions
assetFailureBehaviorstring
Possible Values
IGNOREFAILWARN

Asset failure behavior

Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.

enableAutobooleanstring

Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.

inputsarray

The assets consumed as inputs.

id*string
Min length1
typestring
outputs

The assets produced as outputs.

id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*string
Min length1

Custom asset type

descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150

Client ID of the Azure AD application

Application (client) ID used for service principal authentication.

Client secret for the Azure AD application

Secret value associated with the client ID; store in a Kestra secret.

DefaultSTORE
Possible Values
STOREFETCHFETCH_ONENONE

Result fetching mode

STORE writes ION to internal storage, FETCH returns all rows, and FETCH_ONE returns the first row. Other modes are unsupported.

Defaulthttps://api.loganalytics.io

Log Analytics endpoint

Base URL of the Log Analytics query API. Defaults to https://api.loganalytics.io (public cloud). Override it for sovereign clouds, for example https://api.loganalytics.us (Azure Government) or https://api.loganalytics.azure.cn (Azure China). The access token scope is derived from this endpoint. Microsoft Entra sign-in uses the public authority unless the worker sets the AZURE_AUTHORITY_HOST environment variable, for example https://login.microsoftonline.us.

PEM-encoded certificate content for client authentication

PEM text for certificate-based auth; alternative to clientSecret.

DefaultPT3M

Server timeout

Positive ISO-8601 duration, at most PT10M. Defaults to PT3M.

DefaultPT24H

Query timespan

Positive ISO-8601 look-back duration. Defaults to P1D.

Primary result table columns

Definitions
namestring

Column name

typestring

Kusto column type

Number of returned or stored rows

First row

Present for nonempty FETCH_ONE results.

SubTypeobject

All rows

Present for FETCH.

Formaturi

Stored ION URI

Present for STORE.

More Plugins in this Category

Firecrawl
Firecrawl

Tasks that scrape and crawl websites into clean, LLM-ready content with Firecrawl.

Data

2 tasks

Canonical (EE)
Canonical
Enterprise

Tasks to interact with Canonical services, enabling automation and infrastructure management through API-driven workflows.

CloudInfrastructure

5 tasks