1. Log in to your Lumu account through the Lumu Portal and navigate to the integrations screen. Click on the SecOps tab.
2. Locate the MS Sentinel integration in the available apps area and click Add.
3. Review the detailed description provided for the app to familiarize yourself with the integration and click Activate to begin the activation process.
4. Carefully read the instructions provided. Once ready, click on Activate. You will be redirected to Microsoft to complete the integration activation.
5. The Microsoft sign-in page will appear as shown below
6. After successfully authenticating your account, a window listing the permissions needed will open. It's crucial to check the box labeled Consent on behalf of your organization to proceed. Click on Accept
7. Select the subscription for the integration. Remember that you need an active subscription that supports Azure Monitor services, specifically the Logs Ingestion API, and with an associated Log Analytics workspace. After selecting the subscription click on Next.
8. Provide a description for the integration, choose the workspace where the logs will be ingested, and specify a table name. Lumu provides a suggested name for the table, but you can name it as you prefer.
9. For the next step, choose the Lumu events you want to send to Microsoft Sentinel. Note that the 'New Incident Created' event is always selected and sent. Once you have selected the events, click on Activate.
10. Wait for Lumu to set up the collection mechanism.
11. Once it’s finished you can click Close
12. Your integration will be created with the subscription, workspace, table name, and selected events.