Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Authomize Data Connector

View on GitHub ↗Original file ↗

Description

The Authomize Data Connector provides the capability to ingest custom log types from Authomize into Microsoft Sentinel.
Declared status
1
Declared author / publisher
Authomize

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Authomize_v2_CL

Declared permissions

read and write permissions are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Include custom pre-requisites if the connectivity requires - else delete customs
Description for any custom pre-requisite

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

1. Locate your Authomize API key
Follow the setup instructions [located under Data Connectors for Authomize](https://github.com/authomize/Open-ITDR/blob/main/Open-Connectors/Platform/Azure-Sentinel/Data%20Connectors/readme.md).
2. Deploy the Authomize data connector using the setup instructions.
Follow the Instructions on [deploying the data connector to ingest data from Authomize](https://github.com/authomize/Open-ITDR/blob/main/Open-Connectors/Platform/Azure-Sentinel/Data%20Connectors/readme.md).
3. Finalize your setup
Validate that your script is running. Simple instructions are located under the [Authomize Data Connector area](https://github.com/authomize/Open-ITDR/blob/main/Open-Connectors/Platform/Azure-Sentinel/Data%20Connectors/readme.md).

Related content

Links established from declared identifiers and solution manifests.

Analytics rules21
Access to AWS without MFAMediumAdmin password not updated in 30 daysMediumAdmin SaaS account detectedLowAWS role with admin privilegesHighAWS role with shadow admin privilegesHighDetect AWS IAM UsersHighEmpty group with entitlementsInformationalIaaS admin detectedMediumIaaS policy not attached to any identityInformationalIaaS shadow admin detectedHighLateral Movement Risk - Role Chain LengthInformationalNew direct access policy was granted against organizational policyLowNew service account gained access to IaaS resourceInformationalPassword Exfiltration over SCIM applicationHighPrivileged Machines Exposed to the InternetHighRefactor AWS policy based on activities in the last 60 daysHighStale AWS policy attachment to identityLowStale IAAS policy attachment to roleInformationalUnused IaaS PolicyHighUser assigned to a default admin roleHighUser without MFAMedium
Solutions1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
Authomize
Additional source files 2Solutions/Authomize/Data Connectors/AuthomizeCustomConnector.jsonsource ↗Solutions/Authomize/Data/Solution_Authomize.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.