Skip to main content
Preview. To discuss access to audit streaming for your organisation, contact your Wordsmith account manager.
The Wordsmith solution for Microsoft Sentinel polls your organisation’s audit feed every 5 minutes through the Codeless Connector Framework. It adds:
  • the Wordsmith Audit Log data connector and the WordsmithAudit_CL table;
  • ASIM parsers vimAuditEventWordsmith and vimAuthenticationWordsmith, so Wordsmith events appear in imAuditEvent and imAuthentication queries once you add them to the unifying parsers;
  • a workbook with activity, top actors, failures, administrative changes and sign-in locations;
  • analytics rule templates for role changes, company-wide access changes, API keys, streaming destinations, export bursts, MCP tool failures, sign-in failure bursts and sign-ins from a new country.

​
Before you start

  1. Audit log must be on for your organisation.
  2. Sign in to Wordsmith as a user with audit export permission. Use a dedicated service user: an API key stops working when its owner is removed.
  3. Go to Settings > API keys and create a key with the audit:read scope. Copy it; Wordsmith shows it once.

​
Install

  1. Download the Sentinel solution from Settings > Audit log > Streaming. It contains mainTemplate.json and createUiDefinition.json.
  2. In the Azure portal, open Deploy a custom template, load both files, and choose your Sentinel workspace.
  3. In Microsoft Sentinel, open Data connectors, select Wordsmith Audit Log, and enter:
  4. Select Connect. Data appears within 30 minutes.
  5. Under Analytics > Rule templates, enable the Wordsmith rules you want and adjust their thresholds.

​
Reading the data

Each row is one audit event. TimeGenerated is when the event happened; Azure Monitor replaces values more than two days old with the ingestion time, so EventOccurredAt always keeps the original time. Delivery is at-least-once, so the same event can arrive twice. Deduplicate on EventId:
Events name the fields that changed (ChangedFields) but never their old or new values. Confirm the details of an alert in Wordsmith under Settings > Audit log.