Microsoft Sentinel

Bring the Wordsmith audit log into Microsoft Sentinel with the Wordsmith solution and its codeless connector.

Preview. Audit streaming is available to organisations in the audit streaming pilot.

The Wordsmith solution for Microsoft Sentinel polls your organisation’s audit feed every 5 minutes through the Codeless Connector Framework. It adds:

• the Wordsmith Audit Log data connector and the WordsmithAudit_CL table;
• ASIM parsers vimAuditEventWordsmith and vimAuthenticationWordsmith, so Wordsmith events appear in imAuditEvent and imAuthentication queries once you add them to the unifying parsers;
• a workbook with activity, top actors, failures, administrative changes and sign-in locations;
• analytics rule templates for role changes, company-wide access changes, API keys, streaming destinations, export bursts, MCP tool failures, sign-in failure bursts and sign-ins from a new country.

Before you start

1. Audit log must be on for your organisation.
2. Sign in to Wordsmith as a user with audit export permission. Use a dedicated service user: an API key stops working when its owner is removed.
3. Go to Settings > API keys and create a key with the audit:read scope. Copy it; Wordsmith shows it once.

Install

1. Download the Sentinel solution from Settings > Audit log > Streaming. It contains mainTemplate.json and createUiDefinition.json.

2. In the Azure portal, open Deploy a custom template, load both files, and choose your Sentinel workspace.

3. In Microsoft Sentinel, open Data connectors, select Wordsmith Audit Log, and enter:

   Field	Value
   API base URL	https://api.wordsmith.ai (Europe) or https://api.us.wordsmith.ai (United States)
   API key	The key from step 3 above

4. Select Connect. Data appears within 30 minutes.

5. Under Analytics > Rule templates, enable the Wordsmith rules you want and adjust their thresholds.

Reading the data

Each row is one audit event. TimeGenerated is when the event happened; Azure Monitor replaces values more than two days old with the ingestion time, so EventOccurredAt always keeps the original time.

Delivery is at-least-once, so the same event can arrive twice. Deduplicate on EventId:

WordsmithAudit_CL
| summarize arg_max(TimeGenerated, *) by EventId
| where Category == "identity_management"

Events name the fields that changed (ChangedFields) but never their old or new values. Confirm the details of an alert in Wordsmith under Settings > Audit log.

Related pages

• List Audit Events: the feed the connector polls, its event fields and its errors.
• Splunk, Amazon S3 and Security Lake and HTTPS receiver: the other ways to collect the audit log.