↳ Source GitHubConnecteur
XBOW Security Platform (via Azure Function)
Description
The **XBOW** data connector ingests asset snapshots, vulnerability findings, and assessment activity from the [XBOW Security Platform](https://console.xbow.com) into Microsoft Sentinel. An Azure Function polls the XBOW API on a timer and pushes asset JSON snapshots into `XbowAssets_CL`, enriched findings (with evidence, PoC recipes, impact, and mitigations) into `XbowFindings_CL`, and assessment lifecycle events into `XbowAssessments_CL`, using the [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview) (DCE/DCR).
- Statut déclaré
- 1
- Auteur / éditeur déclaré
- XBOW
Sources déclarées
Métadonnées du fichier source. Aucune dépendance déduite du KQL.
Types de données
Permissions déclarées
read and write permissions on the workspace are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
XBOW API Token
A XBOW Personal Access Token is required. Generate one in the [XBOW console](https://console.xbow.com) under **Settings > Personal Access Tokens**. Scope the token to the organization you want to monitor.
XBOW Organization ID
The Organization ID from your XBOW account. Find it in the XBOW console URL or via the API.
Microsoft.Web/sites permissions
Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/).
Custom prerequisites if necessary, otherwise delete this customs tag
Description for any custom pre-requisites
Azure AD App Registration
An Azure AD App Registration (service principal) is required. You must manually assign the **Monitoring Metrics Publisher** role on the Data Collection Rule (DCR) to this App Registration after deployment.
Instructions du connecteur
Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.
>**NOTE:** This connector uses Azure Functions and the Azure Monitor Ingestion API (DCE/DCR) to ingest XBOW assets, findings, and assessments into Microsoft Sentinel. The ARM template automatically creates the Data Collection Endpoint, custom log tables (`XbowAssets_CL`, `XbowFindings_CL`, and `XbowAssessments_CL`), Data Collection Rule, and Function App. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) and [Azure Monitor pricing page](https://azure.microsoft.com/pricing/details/monitor/) for details.
>**(Optional Step)** Securely store your XBOW API Token and App Registration credentials in Azure Key Vault. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault references with an Azure Function App.
STEP 1 – Generate a XBOW API Token
1. Log into the [XBOW console](https://console.xbow.com) with administrator access.
2. Click your profile icon (top right) and select **Settings**.
3. In the left sidebar, click **Personal Access Tokens**.
4. Click **Generate new token**, provide a name, and select the organization scope.
5. Copy and securely store your token — it will not be shown again.
6. Note your **Organization ID** from the XBOW console or from the URL when viewing your organization.
STEP 2 – Create an Azure AD App Registration and Grant DCR Role
1. In the [Azure Portal](https://portal.azure.com), navigate to **Azure Active Directory > App registrations > New registration**.
2. Provide a name (e.g. `Xbow-Sentinel-Connector`) and register.
3. Under **Certificates & secrets**, create a new client secret. Note the **Tenant ID**, **Client ID**, and **Client Secret**.
4. Deploy the connector using Step 3 below, then return here.
5. Open the deployed **Data Collection Rule** (from the deployment outputs or by searching in the resource group).
6. Go to **Access control (IAM) > Add role assignment**.
7. Select role **Monitoring Metrics Publisher**.
8. Assign access to the App Registration (service principal) created above.
9. Wait a few minutes for RBAC propagation before verifying ingestion.
STEP 3 – Deploy the Azure Function App
Click **Deploy to Azure** and fill in the parameters. The template will automatically create the Data Collection Endpoint, `XbowAssets_CL`, `XbowFindings_CL`, and `XbowAssessments_CL` tables, Data Collection Rule, and Function App.
[](https://aka.ms/sentinel-Xbow-azuredeploy)
**Parameters to fill in:**
| Parameter | Description |
|---|---|
| `WorkspaceName` | Name of your Log Analytics / Microsoft Sentinel workspace |
| `XbowApiToken` | XBOW Personal Access Token from Step 1 |
| `XbowOrgId` | XBOW Organization ID from Step 1 |
| `TenantId` | Azure AD Tenant ID from Step 2 |
| `ClientId` | App Registration Client ID from Step 2 |
| `ClientSecret` | App Registration Client Secret from Step 2 |
| `AppInsightsWorkspaceResourceID` | Full Resource ID of the Log Analytics workspace (from **Log Analytics workspace > Properties**) |
| `FunctionAppLocation` | Optional Azure region for Function App resources (defaults to the Resource Group location) |
Workspace ID
Contenus associés
Liens établis à partir des identifiants déclarés et des manifests des solutions.
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
629d1d3↗- Identifiant source
XbowSecurityConnector
GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC