Threat & Vulnerability · Integration
Embed a Microsoft Sentinel integration in your product
Add Microsoft Sentinel to your product for your customers, and give your AI agents governed access to it.
Embed a Microsoft Sentinel integration so your customers can surface security incidents and alerts inside your product, with access scoped per tenant and every read logged. fastn handles authentication and API upkeep per customer, so SIEM signal reaches your product without an integration per tenant.
In your product
Embedded for your customers. Per-tenant auth, customized per customer, maintained by fastn.
Let customers read incidents and their alerts into your product.
Update incident status or ownership from your product with permissions you control.
Run hunting queries and read results where analysts already work.
Trigger your product when a high-severity incident is created.
For your AI agents
Governed, audited access for the agents you build, through the MCP server.
An agent summarises open incidents before a handover.
An agent updates incident status within governed permissions.
An agent reacts to a new high-severity incident and assembles the initial brief.
Example prompt
List open high-severity incidents and the alerts contributing to each.
Set up Microsoft Sentinel in 4 steps
- 01Open the Microsoft Sentinel connector from your fastn dashboard.
- 02Have each customer authenticate their Azure subscription with the required scopes.
- 03Map the workspaces and severity thresholds your product surfaces, then enable actions and triggers.
- 04Call them from your product, or expose them to an agent through the MCP server.
Why teams use the Microsoft Sentinel integration
What you get by embedding it with fastn instead of building it yourself.
- Ship a Microsoft Sentinel integration without building it. Your customers connect their own Microsoft Sentinel account inside your product and work their findings, detections and assets there, and nothing lands on your team.
- Handle the part that actually costs time: a rescan re-reports everything, so the same finding arriving twice must not read as two problems. fastn owns the auth, token refresh, rate limits, pagination and breaking-change fixes, so a Microsoft Sentinel update is not your on-call problem.
- One integration serves your product and your agents. The same governed Microsoft Sentinel integration powers in-product features and gives AI agents scoped, audited access, so you get security findings in front of the people and apps that act on them without wiring it twice.
Used by these teams
Compare with
AWS Security Hub
CrowdStrike FalconWorks well with
Azure MonitorOften used alongside
Tools the same teams tend to run next to Microsoft Sentinel, across other categories.
ServiceNow
Okta
Datadog
PagerDuty
Cisco UmbrellaMore in Threat & Vulnerability
Other Threat & Vulnerability apps your customers can connect the same way. All Threat & Vulnerability integrations
SentinelOne
Qualys
Tenable
Lacework
DrataMicrosoft Sentinel integration FAQ
How do I add a Microsoft Sentinel integration to my product?
Enable the Microsoft Sentinel connector in your fastn dashboard, then let each customer authenticate their own Microsoft Sentinel account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no Microsoft Sentinel client code in your app and no per-customer branch in your codebase. Setup is 4 steps.
Do my customers each connect their own Microsoft Sentinel account?
Yes. Every integration is scoped to the individual customer, so each authorises their own Microsoft Sentinel account and only ever sees their own findings, detections and assets. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.
Can AI agents use this Microsoft Sentinel integration?
Yes. The same integration is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. An agent summarises open incidents before a handover. A prompt that works on day one: "List open high-severity incidents and the alerts contributing to each."
Who maintains the Microsoft Sentinel integration?
fastn does. When Microsoft Sentinel changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' integrations keep working.
How does a new Microsoft Sentinel finding reach my product?
Through event triggers rather than polling, delivered per tenant, so your product reacts when a finding is raised or its severity changes rather than on a schedule that is always slightly out of date.
How is Microsoft Sentinel finding noise kept manageable?
Findings are deduplicated per asset so a rescan does not re-raise what you already have, and you can filter by severity and status before anything reaches your product. That matters more here than in most integrations, because the volume is what stops teams acting on any of it.
What can I build with the Microsoft Sentinel integration?
A common starting point: read incidents and their alerts into your product. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.
How much does the Microsoft Sentinel integration cost?
It is included. Pricing is based on customer connections, not on how many connectors you enable, so adding Microsoft Sentinel does not change your cost. You can start free with 3 customer connections.
Add Microsoft Sentinel to your product
Start free with 3 customer connections. No sales call required, and no per-customer integration code.