Description
This connector uses the Netclean Webhook (required) and Logic Apps to push data into Microsoft Sentinel Log Analytics
- Declared status
- 1
- Declared author / publisher
- NetClean Technologies
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
read and write permissions are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
>**NOTE:** NetClean ProActive uses a Webhook to expose incident data, Azure Logic Apps is used to receive and push data to Log Analytics This might result in additional data ingestion costs.
It's possible to test this without Logic Apps or NetClean Proactive see option 2
Workspace ID
Primary Key
1. Create a new logic app
Use When a HTTP request is recived as the Trigger and save it. It will now have generated a URL that can be used in the ProActive webconsole configuration.
Add an action:
Select the Azure Log Analytics Data Collector and choose Send Data
Enter Connection Name, Workspace ID and Workspace Key, you will find the information needed in your Log Analytics workspace under Settings-->Agents-->Log Analytics agent instructions.
In JSON Request body add @triggerBody(). in Custom Log Name add Netclean_Incidents.
Option 1: Logic app
Ingest data using a api function. please use the script found on
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api?tabs=powershell
Replace the CustomerId and SharedKey values with your values
Replace the content in $json variable to the sample data found here: https://github.com/Azure/Azure-Sentinel/blob/master/Sample%20Data/Custom/Netclean_Incidents_CL.json .
Set the LogType varible to **Netclean_Incidents_CL**
Run the script
Option 2 (Testing only)
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
Netclean_ProActive_Incidents
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC