aiFObserve
Distributed, Contextual Visibility & Governance for Enterprise AI Traffic. No Agents, No APIs, No
Microsoft Sentinel OTLP Capture Guide For Unified aiFObserve
Best Capture Source
Export normalized security events from Microsoft Sentinel or from the OpenTelemetry Collector pipeline that receives Sentinel events. Preserve table name, workspace, subscription, resource, and original event fields.
Basic Logging
- TimeGenerated
- source and destination IP
- source and destination port
- protocol
- action or result
- URL, host, application, or cloud app name
- user principal name or account
- device/vendor/product
- rule, alert, analytic rule, or policy name
- request and response bytes, if available
Extended Logging
- TenantId
- workspace ID and resource ID
- Azure subscription ID and resource group
- table name, category, operation name
- alert severity, tactics, techniques, and incident ID
- entity mappings for account, IP, URL, host, and cloud application
- original raw event body
- geo/IP enrichment
- cloud region and data residency attributes
User And App Identity
- UserPrincipalName
- Account, AccountName, AccountUPN
- Entra ID object ID, tenant ID, and application ID
- cloud app/entity fields
- URL/host/domain fields
OTLP Mapping Notes
Put Sentinel-specific values in OTLP attributes. Keep Timestamp, ObservedTimestamp, SeverityText, SeverityNumber, Body, Resource, and Attributes intact so the converter can map both standard and vendor fields.
VALIDATION NOTE: UserPrincipalName, AccountName, TenantId, AlertName, and host/destination-domain resolution were all tested end-to-end against the real converter and resolved exactly as documented.