> ## Documentation Index
> Fetch the complete documentation index at: https://wordsmithai.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Sentinel

> Bring the Wordsmith audit log into Microsoft Sentinel with the Wordsmith solution and its codeless connector.

> [!NOTE]
>
> **Preview.** To discuss access to audit streaming for your organisation, contact your Wordsmith account manager.

The Wordsmith solution for Microsoft Sentinel polls your organisation's audit feed every 5 minutes through the Codeless Connector Framework. It adds:

* the **Wordsmith Audit Log** data connector and the `WordsmithAudit_CL` table;
* ASIM parsers `vimAuditEventWordsmith` and `vimAuthenticationWordsmith`, so Wordsmith events appear in `imAuditEvent` and `imAuthentication` queries once you add them to the unifying parsers;
* a workbook with activity, top actors, failures, administrative changes and sign-in locations;
* analytics rule templates for role changes, company-wide access changes, API keys, streaming destinations, export bursts, MCP tool failures, sign-in failure bursts and sign-ins from a new country.

## Before you start

1. Audit log must be on for your organisation.
2. Sign in to Wordsmith as a user with audit export permission. Use a dedicated service user: an API key stops working when its owner is removed.
3. Go to **Settings** > **API keys** and create a key with the `audit:read` scope. Copy it; Wordsmith shows it once.

## Install

1. Download the Sentinel solution from **Settings** > **Audit log** > **Streaming**. It contains `mainTemplate.json` and `createUiDefinition.json`.

2. In the Azure portal, open **Deploy a custom template**, load both files, and choose your Sentinel workspace.

3. In Microsoft Sentinel, open **Data connectors**, select **Wordsmith Audit Log**, and enter:

   | Field | Value |
   | - | - |
   | API base URL | `https://api.wordsmith.ai` (Europe) or `https://api.us.wordsmith.ai` (United States) |
   | API key | The key from step 3 above |

4. Select **Connect**. Data appears within 30 minutes.

5. Under **Analytics** > **Rule templates**, enable the Wordsmith rules you want and adjust their thresholds.

## Reading the data

Each row is one audit event. `TimeGenerated` is when the event happened; Azure Monitor replaces values more than two days old with the ingestion time, so `EventOccurredAt` always keeps the original time.

Delivery is at-least-once, so the same event can arrive twice. Deduplicate on `EventId`:

```kusto theme={null}
WordsmithAudit_CL
| summarize arg_max(TimeGenerated, *) by EventId
| where Category == "identity_management"
```

Events name the fields that changed (`ChangedFields`) but never their old or new values. Confirm the details of an alert in Wordsmith under **Settings** > **Audit log**.

## Related pages

* [List Audit Events](https://wordsmithai.mintlify.site/api-reference/audit/list-audit-events.md): the feed the connector polls, its event fields and its errors.
* [Splunk](https://wordsmithai.mintlify.site/siem/splunk.md), [Amazon S3 and Security Lake](https://wordsmithai.mintlify.site/siem/aws.md) and [HTTPS receiver](https://wordsmithai.mintlify.site/siem/https.md): the other ways to collect the audit log.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.