> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/getting-started/onboarding/connectors/microsoft-sentinel.md).
# Microsoft Sentinel
### Step 1: Make a New App Registration
Go to [https://portal.azure.com](https://portal.azure.com/)
Search for “App registration” and click “New registration”
Give the app the name “CybaVerse Ms Sentinel” and click “Register”
### Step 2: Add API Permissions
Click on “API permission”
Click on “Add a permission” then "Microsoft Graph"
Click on “Application permission” and look for the following permission:
* Security Alert > SecurityAlert.Read.All > Add permission
Repeat the above and look for the following permission:
* Security Incident > SecurityIncident.Read.All> add permission
Click on Grant admin consent
Click on: **Certificates & secret** > New client secret > Add a description, for example, ‘CybaVerse Platform’ > expiration 24 months > add
Take a note of:
* **Value**
* **Secret ID**
Go to the overview page and take note of the following details
* **Client ID**
* **Tenant ID**
* **Object ID**
### Step 3: Add Role Assignments
Go to “Subscriptions”
Click on the subscription monitored by CybaVerse then “Access control (IAM)”
Click on: Role assignments > Add > Add role assignment
1. Look for the following role “**Security Reader**” > next > Select members > look for CybaVerse app > Select
2. Make sure the assign type is **permanent**
3. Click "Review + assign"
Repeat steps 1-3 for the role of **Microsoft Sentinel Reader**.
## MS Sentinel Connector in CybaOps
Log in to CybaOps and click on your username to open up the Settings page options. Click Company Details.
Click on Connectors in the top right corner.
Look for Microsoft Sentinel Connector and click Connect.
Add the Tenant ID, Client ID, Secret Token, Resource Group Name, Subscription ID, Workspace Name and Expiry date.
Once that’s all complete, click Connect.
This will trigger the data to start syncronising and a regular schedule will be created.
### Data Synchronisation
The data is pulled every **5 minutes**. The same 5-minute cadence is used for normal operation and routine health checks. If there is **an authentication or authorisation error** (for example, an expired client secret), the connector backs off and retries every **30 minutes**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cybaops.com/getting-started/onboarding/connectors/microsoft-sentinel.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.