Microsoft Sentinel OTLP Capture Guide For Unified aiFObserve

Best Capture Source

Export normalized security events from Microsoft Sentinel or from the OpenTelemetry Collector pipeline that receives Sentinel events. Preserve table name, workspace, subscription, resource, and original event fields.

Basic Logging

• TimeGenerated
• source and destination IP
• source and destination port
• protocol
• action or result
• URL, host, application, or cloud app name
• user principal name or account
• device/vendor/product
• rule, alert, analytic rule, or policy name
• request and response bytes, if available

Extended Logging

• TenantId
• workspace ID and resource ID
• Azure subscription ID and resource group
• table name, category, operation name
• alert severity, tactics, techniques, and incident ID
• entity mappings for account, IP, URL, host, and cloud application
• original raw event body
• geo/IP enrichment
• cloud region and data residency attributes

User And App Identity

• UserPrincipalName
• Account, AccountName, AccountUPN
• Entra ID object ID, tenant ID, and application ID
• cloud app/entity fields
• URL/host/domain fields

OTLP Mapping Notes

Put Sentinel-specific values in OTLP attributes. Keep Timestamp, ObservedTimestamp, SeverityText, SeverityNumber, Body, Resource, and Attributes intact so the converter can map both standard and vendor fields.

Source

• OpenTelemetry Logs Data Model