Description
[NC Protect Data Connector (archtis.com)](https://info.archtis.com/get-started-with-nc-protect-sentinel-data-connector) provides the capability to ingest user activity logs and events into Microsoft Sentinel. The connector provides visibility into NC Protect user activity logs and events in Microsoft Sentinel to improve monitoring and investigation capabilities
- Declared status
- 1
- Declared author / publisher
- archTIS
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
read and write permissions are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
NC Protect
You must have a running instance of NC Protect for O365. Please [contact us](https://www.archtis.com/data-discovery-classification-protection-software-secure-collaboration/).
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
1. Install NC Protect into your Azure Tenancy
2. Log into the NC Protect Administration site
3. From the left hand navigation menu, select General -> User Activity Monitoring
4. Tick the checkbox to Enable SIEM and click the Configure button
5. Select Microsoft Sentinel as the Application and complete the configuration using the information below
6. Click Save to activate the connection
Workspace ID
Primary Key
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
NucleusCyberNCProtect
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC