Microsoft Sentinel (via Webhook)

Send Tenable One AI Exposure findings to Microsoft Sentinel through an Azure Logic App. The Logic App receives findings from a AI Exposure webhook and forwards them to a custom table in your Log Analytics workspace using the Azure Monitor Logs Ingestion API. The Logic App authenticates with a managed identity, so you don't need to store a workspace key.

Prerequisites

Before you begin:

• Ensure you have access to a Log Analytics workspace with Microsoft Sentinel enabled.
• Ensure your Azure account has permissions to create tables, data collection rules (DCRs), data collection endpoints (DCEs), and Logic Apps.
• Ensure your Azure account has permissions to assign roles on the DCR (e.g., the Owner or User Access Administrator role).

To send AI Exposure data to Microsoft Sentinel, follow these steps:

1. Create a Custom Table
2. Copy the DCR and DCE Values
3. Create a Logic App with Managed Identity
4. Grant the Logic App Access to the DCR
5. Create a Sentinel Webhook Integration in Tenable
6. Send data to the webhook in one of the following ways:
   • Automate actions
   • Manually trigger actions based on findings
7. View Data in Microsoft Sentinel

What to do next:

• To start sending data for findings, you need to also configure automation rules or manually trigger an action after you add the integration. Successfully completing all integration steps doesn't trigger the sending of any data on its own.

Create a Custom Table

Create a custom table in your Log Analytics workspace, along with the DCR and DCE that route AI Exposure data to it.

1. In the Azure portal, navigate to Log Analytics workspaces and select the workspace where Microsoft Sentinel is enabled.
2. Under Settings, select Tables.
3. Click Create > New custom log (DCR based).

4. Enter a Table name, for example TenableFindings.

   Note: Azure automatically adds the _CL suffix, so the full table name is TenableFindings_CL. You need the full name when you create the Logic App and when you View Data in Microsoft Sentinel.
5. For Table plan, select Analytics.
6. Under Data collection rule, select an existing DCR or click Create a new data collection rule and specify the Subscription, Resource group, and Name (for example, dcr-tenable-findings).
7. Under Data collection endpoint, select an existing DCE or create a new one.
8. Click Next.

9. Save the following sample payload as a .json file, and then upload it to generate the table schema.

   Sample payload

   Copy

   JSON

   [
     {
       "source": "source",
       "sentBy": "Tenable",
       "comments": [
         {
           "message": "message",
           "time": "2026-01-15T14:30:00.000000Z",
           "userName": "User Name"
         }
       ],
       "creationTime": "2026-01-10T08:00:00.000Z",
       "id": "00000000-0000-0000-0000-000000000000",
       "link": "https://example.com/customer/00000000-0000-0000-0000-000000000000/Risks/Cloud/Closed#risk/00000000-0000-0000-0000-000000000000",
       "severity": "High",
       "ticketLinks": [],
       "accountId": "123456789012",
       "accountName": "ExampleAccount",
       "category": "exampleCategory",
       "description": "exampleDescription",
       "openTime": "2026-01-10T08:00:00.000Z",
       "policyName": "example policy",
       "provider": "exampleProvider",
       "status": "exampleStatus",
       "statusUpdateTime": "2026-01-15T14:30:00.000Z",
       "subStatus": "exampleSubStatus",
       "type": "exampleType",
       "compliances": [
         "exampleCompliance1",
         "exampleCompliance2"
       ],
       "ignoredUntil": "2026-01-15T14:30:00.000Z",
       "resource": "ExampleResourceName"
     }
   ]

10. Add a TimeGenerated column. Every Azure Monitor log table requires one, and the AI Exposure payload doesn't include it, so the portal displays a warning.
    1. Click Transformation editor.

    2. Enter the following query, and then click Run:

       Copy

       KUSTO

       source
       | extend TimeGenerated = todatetime(statusUpdateTime)

    3. Click Apply.
11. Click Next, and then click Create.

Copy the DCR and DCE Values

Copy the values that the Logic App needs to send data to your DCR.

1. In the Azure portal, navigate to Monitor > Data collection rules and select the DCR you created.
2. On the Overview page, click JSON View.
3. Copy and save the immutableId value. It starts with dcr-.
4. Navigate to Monitor > Data Collection Endpoints and select the DCE you selected for the table.
5. Copy and save the Logs ingestion URI.

Create a Logic App with Managed Identity

Configure an Azure Logic App to receive data from Tenable and forward it securely to your DCR.

1. In the Azure portal, navigate to the Logic apps service.
2. Click Add.
3. For hosting option, select Consumption.
4. Under Project details, select the relevant Subscription and Resource group.
5. Under Instance details, enter a Name and select a Region.
6. Click Review + Create and then click Create.
7. When the deployment is complete, click Go to resource.
8. Create the managed identity:
   1. Navigate to Settings > Identity.
   2. On the System assigned tab, set Status to On.
   3. Click Save.
9. Navigate to Development tools > Logic app designer.
10. Click Add a trigger, and then search for and select When a HTTP request is received.
11. Click + and then Add an action.
12. Search for and select the HTTP action.
13. Configure the HTTP action:
    • Method: POST

    • URI — Enter the URI in the following format, using the values you copied earlier and the full table name:

      Copy

      {Logs ingestion URI}/dataCollectionRules/{immutableId}/streams/Custom-{Table name}?api-version=2023-01-01

      For example:

      Copy

      https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com/dataCollectionRules/dcr-000a00a000a00000a000000aa000a0aa/streams/Custom-TenableFindings_CL?api-version=2023-01-01

    • Headers — Add Content-Type with the value application/json.
    • Body — Enter the expression @createArray(triggerBody()). The Logs Ingestion API accepts only a JSON array, and AI Exposure sends each finding as a single JSON object. This expression wraps the object in an array.

14. Under Advanced parameters, select Authentication and configure it:

    • Authentication type: Managed identity
    • Managed identity: System-assigned managed identity
    • Audience: https://monitor.azure.com
    Note: If your workspace is in Azure Government, use https://monitor.azure.us as the audience.
15. Click Save.
16. Open the When a HTTP request is received trigger and copy the HTTP URL. Azure generates this URL when you save the workflow.

Grant the Logic App Access to the DCR

Assign the Logic App's managed identity a role that allows it to send data to your DCR.

1. In the Azure portal, navigate to Monitor > Data collection rules and select the DCR you created.
2. Select Access control (IAM) > Add > Add role assignment.
3. Select the Monitoring Metrics Publisher role and click Next.
4. For Assign access to, select Managed identity.
5. Click Select members, select your Logic App, and then click Select.
6. Click Review + assign.

Create a Sentinel Webhook Integration in Tenable

Create a webhook integration in AI Exposure that sends findings to your Logic App.

1. In the AI Exposure Console, navigate to Settings > Integrations and click Webhook.
2. Click Add webhook.
3. Enter a Name for the webhook (e.g., Sentinel_Modern_Integration.
4. In the Webhook URL field, paste the HTTP URL that you copied in the last step of Create a Logic App with Managed Identity.
5. (Optional) Select Accept any server SSL certificates if SSL is enabled for the collector.
6. (Optional) For HTTP Headers, enter a Name and Value if the webhook expects to receive a header with additional information.
7. Click Save.

View Data in Microsoft Sentinel

Verify that findings reach Microsoft Sentinel.

1. Verify the Logic App run:
   1. In the Azure portal, open the Logic App that you created.
   2. On the Overview page, navigate to the Run history tab and click a run Identifier.
   3. Click the HTTP action and confirm that it succeeded. If it returns 403 Forbidden, the role assignment hasn't taken effect yet.
2. View the data in Microsoft Sentinel:
   1. In the Azure portal, navigate to the Microsoft Sentinel service.
   2. Select your workspace and click Logs.
   3. In a new query (KQL mode), enter the full table name (for example, TenableFindings_CL) and click Run.