# Integration Elastic Security with Microsoft Sentinel available? **URL:** \ **Category:** Elastic Security\ **Created:** [June 1, 2023, 5:19pm UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025 "2023-06-01T17:19:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Jeronimodus](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jeronimodus](https://discuss.elastic.co/u/Jeronimodus)\ **Post date:** [June 1, 2023, 5:19pm UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025/1 "2023-06-01T17:19:43Z")
Hello all, I am looking for a way to import alerts and possibly more data from Sentinel into Elastic Security. I do not see an integration available for this. Is there someone who can confirm that this does not exist and / or someone who can say how this could be implemented? Many thanks. Jeroen ---
**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\ **Post date:** [June 5, 2023, 8:10pm UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025/2 "2023-06-05T20:10:33Z")
Hi @Jeronimodus, I'm not familiar with Sentinel, what does the import data look like? Log file, api, etc? To answer your question, in general if an integration doesn't currently exists you usually can import the data you'll probably use [logstash](https://www.elastic.co/guide/en/logstash/current/index.html) and then map it to the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/index.html). ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [June 5, 2023, 9:08pm UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025/3 "2023-06-05T21:08:11Z")
> [@Jeronimodus](#): > > I do not see an integration available for this. Is there someone who can confirm that this does not exist and / or someone who can say how this could be implemented? If by Sentinel you mean Azure Sentinel, then there is no integration. One alternative to collect logs from Azure Sentinel is using Logstash, you would need to configure your Sentinel to send the logs to an Event Hub then use the `azure_event_hubs` input in Logstash. The log is basically a json, but all the alerts will be sent inside an array named `records`, so you will need a split filter in this field to have each alert as a document. I use the following filters to parse the messages: ```auto json { source => "message" } split { field => "records" } ``` You can then rename the fields you want into equivalent ECS fields. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [June 5, 2023, 10:13pm UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025/4 "2023-06-05T22:13:41Z")
Hi @Jeronimodus Welcome to the community cc @leandrojmp Perhaps I am missing something I was just discussing this with another user today. There is an OOTB integration with SentinelOne and Elastic Agent The [SentinelOne](https://www.sentinelone.com/) integration collects and parses data from SentinelOne REST APIs. > **[SentinelOne | Elastic docs](https://docs.elastic.co/integrations/sentinel_one)** > > Collect logs from SentinelOne with Elastic Agent. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [June 6, 2023, 12:58am UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025/5 "2023-06-06T00:58:30Z")
> [@stephenb](#): > > Perhaps I am missing something I was just discussing this with another user today. > > There is an OOTB integration with SentinelOne and Elastic Agent This is another tool, the question is about [Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/overview) (formerly know as Azure Sentinel), the cloud SIEM/SOAR product from Microsoft. SentinelOne is a different tool by a different company. There is no Elastic Agent integration for Microsoft Sentinel yet. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [June 6, 2023, 1:14am UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025/6 "2023-06-06T01:14:28Z")
Ahhhh thanks... To make it more clear ... Uhh confusing to me [https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-sentinelone?tab=overview](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-sentinelone?tab=overview) So you can buy SentinelOne through Azure marketplace as part of Microsoft Sentinel offering it looks like... I do know SentinelOne is endpoint / XDR among other things because we see it with a number of our users. 🙂 ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [June 6, 2023, 1:20am UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025/7 "2023-06-06T01:20:39Z")
> [@stephenb](#): > > So you can buy SentinelOne through Azure marketplace as part of Microsoft Sentinel offering it looks like... Yeah, Microsoft Sentinel is a SIEM, you can send other logs to it and use its OOTB rules and intelligence to correlate things and get some alerts. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2023, 1:20am UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025/8 "2023-07-04T01:20:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.