Microsoft Sentinel

Forward Cheqpoint approval events to Microsoft Sentinel via the Log Analytics Data Collector API. Correlate AI agent actions with your Azure security signals, build custom workbooks, and trigger playbooks on high-risk decisions.

1. Get your Log Analytics workspace credentials

bash

# In Azure Portal:
# Log Analytics workspaces → <your workspace> → Agents → Log Analytics agent instructions

Workspace ID:  xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Primary Key:   <your primary key>

# You'll use these in the Cheqpoint Sentinel integration config.

2. Configure the integration in Cheqpoint

text

Settings → Integrations → Microsoft Sentinel → Configure

Fields:
  Workspace ID:   <from Azure Portal>
  Shared Key:     <primary key from Azure Portal>
  Log Type:       CheqpointApproval  (custom table name in Sentinel)

Cheqpoint uses the Azure Monitor HTTP Data Collector API:
  POST https://{workspaceId}.ods.opinsights.azure.com/api/logs?api-version=2016-04-01

3. Event payload written to Sentinel

json

// Written to custom table: CheqpointApproval_CL
{
  "RequestId_s":     "req_01j3abc",
  "Action_s":        "transfer_funds",
  "Status_s":        "approved",
  "AgentName_s":     "Finance Bot",
  "RiskScore_d":     0.91,
  "DecidedBy_s":     "cfo@company.com",
  "DecisionNote_s":  "Verified with counterparty - proceed",
  "WorkspaceId_s":   "ws_01j3xyz",
  "Tags_s":          "SOX,EU AI Act",
  "CreatedAt_t":     "2026-10-15T09:12:00Z",
  "DecidedAt_t":     "2026-10-15T09:14:33Z"
}

4. KQL: high-risk AI agent actions

text

CheqpointApproval_CL
| where RiskScore_d > 0.8
| project TimeGenerated, AgentName_s, Action_s, Status_s, DecidedBy_s, RiskScore_d
| order by RiskScore_d desc

5. KQL: agent volume anomaly (7-day baseline)

text

CheqpointApproval_CL
| summarize daily_count = count() by AgentName_s, bin(TimeGenerated, 1d)
| summarize
    avg_daily = avg(daily_count),
    today = maxif(daily_count, TimeGenerated > ago(1d))
  by AgentName_s
| where today > avg_daily * 2
| project AgentName_s, today, avg_daily, spike_ratio = today / avg_daily

6. Analytics rule: repeated rejections

text

// Sentinel Analytics Rule (KQL)
// Triggers when an agent has 3+ rejections in 1 hour

CheqpointApproval_CL
| where Status_s == "rejected"
| summarize RejectionCount = count() by AgentName_s, bin(TimeGenerated, 1h)
| where RejectionCount >= 3
| project TimeGenerated, AgentName_s, RejectionCount

Recommended Sentinel workbooks

AI agent approval rate over time (overall health of agent behaviour)
High-risk action heatmap by agent and action type
Reviewer response time SLA compliance
Regulatory tag coverage (EU AI Act Article 14, SOX, HIPAA)

Playbook triggers

Use Logic Apps playbooks to respond to Cheqpoint events in Sentinel: auto-suspend an agent via the Cheqpoint API when repeated rejections are detected, or page the on-call team via PagerDuty when a high-risk action exceeds a threshold.