APVISO + Microsoft Sentinel Integration

Why connect APVISO with Microsoft Sentinel?

SIEM-Integrated Vulnerability Data

Ingest APVISO findings into Microsoft Sentinel to correlate vulnerability data with security events, alerts, and incidents for a complete security picture.

KQL Queries for Security Analysis

Query APVISO findings using KQL alongside your other Sentinel data sources. Build workbooks and analytics rules that combine vulnerability and threat data.

Automated Response with SOAR

Trigger Sentinel playbooks (Logic Apps) when APVISO discovers critical findings, automating incident creation, notifications, and remediation workflows.

Setup Guide

Configure the APVISO Data Connector

In Microsoft Sentinel, add the APVISO data connector. This configures a Log Analytics workspace table for APVISO vulnerability data.

Provide Log Analytics Credentials

Enter your Log Analytics workspace ID and primary key in APVISO's integration settings. APVISO sends findings to the Data Collector API.

Enable Analytics Rules

Activate pre-built analytics rules that generate Sentinel incidents from APVISO findings, or create custom rules using KQL.

How APVISO Integrates with Microsoft Sentinel

APVISO's Microsoft Sentinel integration sends penetration testing findings to your Azure SIEM platform. For organizations that use Microsoft Sentinel for security operations, this integration adds vulnerability assessment data to your security analytics, enabling correlation between known vulnerabilities and active threats.

Data Ingestion via Log Analytics

APVISO sends findings to Microsoft Sentinel through the Log Analytics Data Collector API. Each finding becomes a record in a custom table (ApvisoFindings_CL) with fields for vulnerability title, severity, CVSS score, affected endpoint, vulnerability category, scan ID, target, and timestamps. This data is retained according to your Log Analytics workspace retention policy and is immediately available for KQL queries.

The Data Collector API approach requires minimal Azure configuration — just a workspace ID and key. No complex Azure AD app registrations or resource deployments are needed.

KQL-Powered Analysis

With APVISO data in Log Analytics, you can write KQL queries to analyze your vulnerability landscape. Query examples include trending finding counts over time, identifying the most common vulnerability categories, calculating remediation velocity, and correlating findings with other Sentinel data sources. These queries power Sentinel workbooks, analytics rules, and hunting queries.

Analytics Rules and Incidents

APVISO provides pre-built analytics rules that generate Sentinel incidents from vulnerability findings. Rules include creating an incident when a Critical finding is discovered, alerting when the same vulnerability is found in consecutive scans (indicating failed remediation), and detecting a spike in finding volume that may indicate a newly introduced vulnerability class. These rules leverage Sentinel's incident management workflow, assigning incidents to analysts and tracking investigation progress.

Workbook Visualization

Sentinel workbooks provide rich dashboards for APVISO data. Pre-built workbooks show vulnerability trends, severity distributions, top affected targets, and remediation timelines. Workbooks support interactive filters for time range, severity, target, and vulnerability category. Custom workbooks can combine APVISO data with other Sentinel data sources for holistic security dashboards.

SOAR Integration

Sentinel's SOAR capabilities (Logic Apps playbooks) enable automated responses to APVISO findings. When a Critical finding triggers an analytics rule, a playbook can automatically create a Jira ticket, post to a Teams channel, notify the on-call team via PagerDuty, and enrich the incident with asset context from your CMDB. This automation ensures consistent, rapid response to security findings.

Frequently Asked Questions

What Log Analytics table does APVISO use?▾

APVISO sends findings to a custom table named ApvisoFindings_CL in your Log Analytics workspace. Each record contains fields for severity, CVSS score, vulnerability category, affected endpoint, and scan metadata.

Can Sentinel playbooks trigger actions on APVISO findings?▾

Yes. When an analytics rule generates an incident from APVISO data, Sentinel playbooks can trigger automated responses like creating Jira tickets, sending Teams notifications, or calling the APVISO API to schedule a retest.

Connect APVISO with Microsoft Sentinel