Azure Sentinel Trigger

Azure Sentinel Trigger
Certified
Trigger flows from Microsoft Sentinel incidents

Emits matching incidents within initialLookback on the first poll and newly modified incidents on subsequent polls, up to maxIncidents per execution. A timestamp and boundary versions are persisted in namespace KV. Polling observes returned incident states and cannot guarantee exactly-once delivery or capture every intermediate update.

yaml
type: io.kestra.plugin.azure.sentinel.Trigger

Examples

React to high severity Sentinel incidents

yaml
id: sentinel_incidents
namespace: company.team
tasks:
  - id: log
    type: io.kestra.plugin.core.log.Log
    message: "Received {{ trigger.count }} Sentinel incidents"
triggers:
  - id: incidents
    type: io.kestra.plugin.azure.sentinel.Trigger
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    clientSecret: "{{ secret('AZURE_CLIENT_SECRET') }}"
    subscriptionId: "{{ secret('AZURE_SUBSCRIPTION_ID') }}"
    resourceGroup: security
    workspaceName: sentinel-workspace
    severities: [High]
    initialLookback: P1D
    maxIncidents: 100
    interval: PT1M

Properties

resourceGroup *string

Azure resource group

Name of the resource group that contains the Sentinel workspace.

subscriptionId *string

Azure subscription ID

ID of the Azure subscription that contains the Sentinel workspace.

workspaceName *string

Sentinel workspace name

ARM resource name of the Log Analytics workspace, not its customer GUID (the workspaceId used by Query).

allowConcurrent boolean

Defaultfalse

Specifies whether a trigger is allowed to start a new execution even if a previous run is still in progress.

armEndpoint string

Defaulthttps://management.azure.com

Azure Resource Manager endpoint

Base URL of the Azure Resource Manager API. Defaults to https://management.azure.com (public cloud). Override it for sovereign clouds, for example https://management.usgovcloudapi.net (Azure Government) or https://management.chinacloudapi.cn (Azure China). The access token scope is derived from this endpoint (<endpoint>/.default). Microsoft Entra sign-in uses the public authority unless the worker sets the AZURE_AUTHORITY_HOST environment variable, for example https://login.microsoftonline.us.

clientId string

Client ID

clientSecret string

Client secret

filter string

OData filter

Raw OData predicate, combined with severity, status, and watermark filters using AND.

initialLookback string

DefaultPT24H

Initial lookback

Positive duration, default P1D. Limits the first poll to recently modified incidents; ignored once a watermark exists.

interval string

DefaultPT1M

Formatduration

Polling interval

maxIncidents integerstring

Default100

Maximum incidents

Maximum number of fresh incidents per execution, between 1 and 1000. Defaults to 100. Remaining incidents are eligible on subsequent polls.

pemCertificate string

PEM certificate

severities array

SubTypestring

Possible Values

HighMediumLowInformational

Incident severities

Severities to keep: High, Medium, Low or Informational. Values within this list are combined using OR.

statuses array

SubTypestring

Possible Values

NewActiveClosed

Incident statuses

Statuses to keep: New, Active or Closed. Values within this list are combined using OR.

stopAfter array

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of execution states after which a trigger should be stopped (a.k.a. disabled).

tenantId string

Tenant ID

top integerstring

Default100

Page size

Number of incidents requested per page, between 1 and 1000. Defaults to 100. maxIncidents limits the emitted batch.

when string

Defaulttrue

A condition that determines whether the trigger should run.

A Pebble expression evaluated at trigger time. The trigger fires only when the expression evaluates to a truthy value (true, a non-empty string, a non-zero number). Use this to gate trigger execution on dynamic runtime values such as execution labels, flow variables, or environment conditions.

Outputs

count integer

Incident count

incidents array

SubTypeobject

New or modified incidents