BP-2395: Microsoft Sentinel

docs/docs.json

@@ -627,6 +627,13 @@
                   "integrations/cortex-xsoar/reference"
                 ]
               },
+              {
+                "group": "Microsoft Sentinel",
+                "pages": [
+                  "integrations/microsoft/sentinel/configure",
+                    "integrations/microsoft/sentinel/use"
+                ]
+              },
               {
                 "group": "ServiceNow",
                 "pages": [

docs/integrations/microsoft/sentinel/use.mdx

@@ -0,0 +1,92 @@
+---
+title: Use the Microsoft Sentinel Integration with BloodHound Enterprise
+description: View BloodHound Enterprise attack path risk, audit logs, posture trends, and critical asset exposure in Microsoft Sentinel dashboards and incidents.
+sidebarTitle: View attack path data
+---
+
+<img noZoom src="/assets/enterprise-edition-pill-tag.svg" alt="Applies to BloodHound Enterprise only"/>
+
+Workbooks in Microsoft Sentinel provide interactive dashboards that help you review and investigate data.
+
+The BloodHound Enterprise integration includes workbooks that visualize attack path data, audit logs, posture trends, and Tier Zero asset exposure.
+
+You can also use Microsoft Sentinel's incident management capabilities to triage and track remediation of BloodHound Enterprise findings.
+
+<Tip>
+  See the [Microsoft Sentinel documentation](https://learn.microsoft.com/en-us/azure/sentinel/) for more information.
+</Tip>
+
+## Dashboards
+
+Explore the following dashboards to review BloodHound Enterprise data in Microsoft Sentinel.
+
+### Attack Path Overview
+
+Use this dashboard for high-level attack path trends across environments:
+
+- Total attack paths by environment
+- Exposure-oriented metrics such as expected compromise indicators
+- Tier distribution context
+- Environment filtering for focused analysis
+
+### Attack Path Details
+
+Use this dashboard to investigate individual paths and prioritize remediation:
+
+- Timeline and state changes for path findings
+- Affected principals and related objects
+- Exposure and impact context
+- Remediation-linked context for triage
+
+### Audit Logs
+
+Use this dashboard to monitor security-relevant operational changes:
+
+- Create/update/delete activity timeline
+- Actor and object context
+- Environment-level filtering
+
+### Posture
+
+Use this dashboard to monitor posture and progress over time:
+
+- Posture trend metrics
+- Service/control health indicators
+- Environment-to-environment comparison
+
+### Tier Zero Assets
+
+Use this dashboard to prioritize highest-impact exposure:
+
+- Tier Zero principal inventory
+- Exposure-oriented prioritization indicators
+- Relationship context for critical assets
+
+## Work with incidents
+
+Analytics Rules generate incidents from BloodHound Enterprise findings in custom log tables.
+
+1. In Microsoft Sentinel, open **Incidents**.
+1. Filter by BloodHound-related product/source fields.
+1. Triage, assign, and track remediation in your incident workflow.
+
+<Tip>
+  Use incidents for operational ownership and dashboards for trend/coverage analysis.
+</Tip>
+
+## Multi-environment analysis
+
+Use environment filters across dashboards to compare business units, regions, or segmented environments.
+
+- View one environment in isolation.
+- Compare multiple environments side-by-side.
+- Reduce noise by excluding non-relevant environments.
+
+## Data scope and freshness
+
+Dashboard and incident views reflect connector configuration choices:
+
+- Environment and finding-type selection
+- Polling cadence
+- Initial lookback window (`Lookup Days`)
+- Deduplication behavior favoring latest event state

docs/integrations/overview.mdx

@@ -60,6 +60,19 @@ The following integrations are officially supported by SpecterOps.
   | **Integration instructions** | <a href="https://docs.axonius.com/docs/bloodhound">Configure the Axonius adapter for BloodHound</a> |
 </Card>
 
+<Card
+  title="Microsoft Sentinel"
+  href="/integrations/microsoft/sentinel/configure"
+>
+  The Microsoft Sentinel integration enables you to manage and visualize BloodHound Enterprise Attack Path statistics within a Microsoft Sentinel workspace.
+
+  | | |
+  | --- | --- |
+  | **Supported actions** | <ul><li>Fetch Attack Path findings from BloodHound Enterprise.</li><li>Create an incident in Microsoft Sentinel for each finding.</li><li>Ingest and visualize posture statistics, audit logs, and Tier Zero assets in Microsoft Sentinel dashboards.</li></ul> |
+  | **Common use cases** | <ul><li>Automatically convert custom logs into Incidents within Sentinel based on BloodHound Enterprise findings data.</li><li>Empower security analysts to investigate and respond to potential security threats identified by BloodHound Enterprise.</li><li>Use Sentinel Workbooks to visualize and analyze BloodHound Enterprise data for a clear, actionable view of Attack Paths and potential vulnerabilities in Active Directory environments.</li></ul> |
+  | **Integration instructions** | <a href="/integrations/microsoft/sentinel/configure">Configure the Microsoft Sentinel integration</a> |
+</Card>
+
 <Card
   title="Palo Alto XSOAR"
   href="/integrations/cortex-xsoar/configure"