Microsoft Sentinel ASM Integration

Access Levels: Advanced | Enterprise

The Censys connector for Microsoft Sentinel (formerly known as Azure Sentinel) enables you to connect Attack Surface Management (ASM) logbook and risk events with Sentinel. The integration automatically polls Censys for new events, which are then are sent to Microsoft Sentinel. This allows you to monitor your attack surface events in the analytics platform of your choice.

Prerequisites

• To set up this integration, your Azure user must have the Owner or User Access Administrator roles.
• If you use an IP allowlist, permit communication from 52.5.142.59 , 34.226.132.221 , and 52.54.43.157.
• Download the censys-sentinel-dcr.bicep file.
  • This file creates two Data Collection Rule (DCR) custom tables, a Data Collection Endpoint (DCE), and a DCR that maps the Censys streams onto the two custom tables.
• Your Microsoft Sentinel Log Analytics workspace name and resource group.
  • You can retrieve these from Home > Log Analytics workspaces.
  • Your resource group is provided on the Log Analytics workspace overview.

Set up the integration in Microsoft Sentinel

1. Create the app registration

1. In Microsoft Sentinel, go to Entra ID > App registrations > New registration.

2. Enter a recognizable name for the application, like censys-sentinel-ingest.

   • You do not need to add redirect URI nor API permissions are required. Access comes entirely from the role assignment that is set up later.

3. On your new app's registration page, click the link next to "Client credentials."

4. Click New client secret. Enter a name for the secret. Copy the new secret value and store it in a secure location, it will only be shown once.

5. In the app overview, note your Application (client) ID and Directory (tenant) ID. You will need these later during setup.

   

2. Deploy the app template

Open the Azure CLI and run the following command to create the Censys integration DCE and DCR. Replace <rg> with your Log Analytics resource group and <workspace> with your Log Analytics workspace name.

   az deployment group create \
      --resource-group <rg> \
      --template-file censys-sentinel-dcr.bicep \
      --parameters workspaceName=<workspace> namePrefix=censys

3. Grant the app registration access to the DCR and copy DCR and DCE information for ASM setup

1. In Microsoft Sentinel, use the top search bar to search for your new DCR by name and select it. If you used the command exactly as described above, it is censys-dcr.

2. On the DCR, go to Access control (IAM) > Add > Add role assignment.

3. Sarch for and select "Monitoring Metrics Publisher." Click Next.

4. Click Select members then search for and select the app you created in section 1 above. members > search for the app registration by the name from "1. Create the app registration."

5. Click Review + assign.

6. Go back to the overview page for your new DCR. Copy the immutable ID. You will need this in the next step.

7. Go to your new DCE's page. The default name is censys-dce. Copy the "Logs Ingestion" URL.

   

Configure the integration in Censys ASM

1. Go to the Censys ASM web console, then click Integrations.

2. Locate Microsoft Sentinel and click Set Up.

3. Under "Azure API," select Logs Ingestion API. The HTTP Data Collector API is no longer supported.

4. Configure the following:

   1. In the "Tenant ID" field, enter the tenant ID from your app registration page in Sentinel.
   2. In the "Client ID" field, enter the client ID from your app registration page.
   3. In the "Client secret" field, enter the secret you generated for your app registration.
   4. In the "Data collection endpoint" field, enter your DCE ingest URL. https:// is automatically populated and you do not need to include it.

5. Click Next Step.

6. On the "Default Set up" page, paste your DCR immutable ID.

7. Select Logbook, Risks, or both.

8. Click Submit, then click Done.

Censys data sent to Microsoft Sentinel

The following tables detail the objects sent to the custom log analytics tables. Note that the Log Ingestion API adds events to different tables than the deprecated Azure Monitor HTTP data collection API.

Risk events (Censys_Risks_V2_CL)

Logbook events (Censys_Logbook_V2_CL)

Microsoft Sentinel query examples

You can use the following example queries to explore Censys data in Microsoft Sentinel.

Risk events

Open critical risks:

Censys_Risks_V2_CL 
| where Severity_s =~ "Critical" 
| where Risk_Event_Operation_s =~ "Open" 
| where Status_s =~ "Open" 
| sort by Last_Seen_t

Count of risks by name:

Censys_Risks_V2_CL
| summarize Count = count() by Display_Name_s
| order by Count desc

Logbook events

Associated hosts:

Censys_Logbook_V2_CL
| where Operation_s =~ "ASSOCIATE"

Disassociated hosts:

Censys_Logbook_V2_CL

Deprecated Azure Monitor HTTP data collector API configuration

Microsoft retired the Azure Monitor HTTP data collector API on September 14, 2026. Censys ASM previously used this API to connect with Sentinel. Censys does not recommend using this configuration option. The following information is provided below to support users whose integrations are still configured to use the deprecated API.

Censys_Risks_CL 
| where Severity_s =~ "Critical" 
| where Risk_Event_Operation_s =~ "Open" 
| where Status_s =~ "Open" 
| sort by Last_Seen_t

Censys_Risks_CL
| summarize Count = count() by Display_Name_s
| order by Count desc

Censys_Logbook_CL
| where Operation_s =~ "ASSOCIATE"

Censys_Logbook_CL
| where Operation_s =~ "DISSOCIATE"