Description
The **Upwind Catalog Loader** data connector ingests compute platform assets from the [Upwind](https://upwind.io) cloud security platform into a Microsoft Sentinel custom table using an Azure Function and the [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview) (DCE/DCR).
Upwind provides runtime-powered cloud security, correlating cloud posture with live workload context. This connector surfaces your Upwind inventory catalog — compute platform assets across AWS, GCP, and Azure — directly into Microsoft Sentinel for correlation, hunting, and incident enrichment.
- Statut déclaré
- 1
- Auteur / éditeur déclaré
- Upwind
Sources déclarées
Métadonnées du fichier source. Aucune dépendance déduite du KQL.
Types de données
Permissions déclarées
read and write permissions on the workspace are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Microsoft.Web/sites permissions
Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/).
Upwind API Credentials
An Upwind API client ID and client secret are required. Obtain these from your Upwind platform under **Settings → API Keys**. The client credentials are used to authenticate against `https://auth.upwind.io/oauth/token` to obtain a bearer token.
Upwind Organization ID
Your Upwind Organization ID is required. Find it in the Upwind platform under **Settings → Organization**.
Instructions du connecteur
Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.
>**NOTE:** This connector uses Azure Functions and the Azure Monitor Ingestion API (DCE/DCR) to push Upwind catalog assets into Microsoft Sentinel. The ARM template automatically creates the Data Collection Endpoint, custom log table (`UpwindCatalogAssets_CL`), Data Collection Rule, and role assignment. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) and [Azure Monitor pricing page](https://azure.microsoft.com/pricing/details/monitor/) for details.
>**(Optional)** Securely store your Upwind client secret in Azure Key Vault. Set `KEY_VAULT_URI` and `UPWIND_SECRET_NAME` app settings to enable Key Vault retrieval. The function will fall back to the `UPWIND_CLIENT_SECRET` app setting if Key Vault is not configured.
STEP 1 – Obtain Upwind API credentials
1. Log in to the **[Upwind platform](https://app.upwind.io)**.
2. Navigate to **Settings → API Keys**.
3. Create a new API key and note the **Client ID** and **Client Secret**.
4. Navigate to **Settings → Organization** and note your **Organization ID**.
STEP 2 – Deploy the Azure Function App
Click **Deploy to Azure** and fill in the parameters. The template automatically creates the DCE, `UpwindCatalogAssets_CL` table, DCR, role assignment, and Function App.
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FUpwind%2FData%2520Connectors%2Fazuredeploy_UpwindCatalogLoader_API_FunctionApp.json)
**Parameters to fill in:**
| Parameter | Description |
|---|---|
| `WorkspaceName` | Name of your Log Analytics / Microsoft Sentinel workspace |
| `WorkspaceResourceGroup` | *(optional)* Resource group containing that workspace, if different from the one you deploy into |
| `UpwindOrgId` | Upwind Organization ID from Step 1 |
| `UpwindClientId` | Upwind API Client ID from Step 1 |
| `UpwindClientSecret` | Upwind API Client Secret from Step 1 |
| `AppInsightsWorkspaceResourceID` | Full Resource ID of the Log Analytics workspace (from **Log Analytics workspace → Properties**) |
| `UpwindThreatLookbackMinutes` | *(optional, default 90)* Lookback window in minutes for threat detections, threat events, threat stories, and configuration findings |
Workspace ID
Contenus associés
Liens établis à partir des identifiants déclarés et des manifests des solutions.
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
629d1d3↗- Identifiant source
UpwindCatalogLoader
GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC