Requirements

• An active Azure subscription to enable Azure Monitor services
• An active Lumu Insights or Lumu Defender subscription

Add Integration

If you operate a multi-tenant organization in Microsoft Entra ID, you must create an admin user on the tenant you want to integrate into Lumu before proceeding. This will be the user the integration will be configured for. Please, refer to the Multitenant organization capabilities in Microsoft Entra ID from Microsoft for more details.

1. Log in to your Lumu account through the Lumu Portal and navigate to the integrations screen. Click on the SecOps tab. 

2. Locate the MS Sentinel integration in the available apps area and click Add.

3. Review the detailed description provided for the app to familiarize yourself with the integration and click Activate to begin the activation process.

4. Carefully read the instructions provided. Once ready, click on Activate. You will be redirected to Microsoft to complete the integration activation.

5. The Microsoft sign-in page will appear as shown below

Make sure to log in with an administrator account, as only an administrator can grant the required permissions on behalf of your organization.

6. After successfully authenticating your account, a window listing the permissions needed will open. It's crucial to check the box labeled Consent on behalf of your organization to proceed. Click on Accept

​

7. Select the subscription for the integration. Remember that you need an active subscription that supports Azure Monitor services, specifically the Logs Ingestion API, and with an associated Log Analytics workspace. After selecting the subscription click on Next.

8. Provide a description for the integration, choose the workspace where the logs will be ingested, and specify a table name. Lumu provides a suggested name for the table, but you can name it as you prefer.

9. For the next step, choose the Lumu events you want to send to Microsoft Sentinel. Note that the 'New Incident Created' event is always selected and sent. Once you have selected the events, click on Activate.

10. Wait for Lumu to set up the collection mechanism.

11. Once it’s finished you can click Close

12. Your integration will be created with the subscription, workspace, table name, and selected events.

If the collection mechanism created by Lumu in Azure is deleted, the integration will break.