Description
The [Cybereinforce Threat Enforcement](https://cybereinforce.com) data connector ingests browser-level URL blocking, threat-intelligence match, and audit/administration events into Microsoft Sentinel using a scheduled Logic App and the Azure Monitor Logs Ingestion API. Cybereinforce enforces Microsoft Defender threat intelligence directly at the browser (Chrome, Firefox, Safari) on enrolled endpoints, and this connector surfaces that enforcement activity for SOC investigation, hunting, and alerting.
- Declared status
- 1
- Declared author / publisher
- Cybeurope
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
read and write permissions are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Azure Subscription
Contributor or Owner permissions on the resource group are required to deploy the data ingestion infrastructure (Data Collection Endpoint, Data Collection Rule, custom table, and Logic App).
Cybereinforce Account
An active Cybereinforce Threat Enforcement tenant with admin access to generate a MicrosoftToken from the Cybereinforce Admin portal.
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
Step 1 - Generate a Cybereinforce MicrosoftToken
1. Sign in to the [Cybereinforce Admin portal](https://cybereinforce.com/admin/).
2. Under **Integrations**, find the **MicrosoftToken** section.
3. Click **Generate MicrosoftToken (/api/microsoftToken)**.
4. Copy the generated token and your Cybereinforce **Tenant ID** - both are required for the deployment in Step 2.
Step 2 - Deploy the data ingestion infrastructure
This step deploys the required Azure resources: a custom Log Analytics table (`CybereinforceCTE_CL`), a Data Collection Endpoint, a Data Collection Rule, a user-assigned managed identity, and a Logic App that polls Cybereinforce on a schedule and forwards new events into the table.
1. Click the **Deploy to Azure** button below.
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCybereinforce%2FData%20Connectors%2Fdeployment%2Fazuredeploy_cybereinforce.json)
2. Select the **Subscription**, **Resource Group**, and **Location** where your Microsoft Sentinel workspace resides.
3. Enter the **Log Analytics Workspace Resource ID**, the **Cybereinforce Tenant ID**, and the **MicrosoftToken** copied in Step 1.
4. Click **Review + create** and then **Create**.
Step 3 - Confirm ingestion
After a few polling cycles (default every 15 minutes), new events should appear in the `CybereinforceCTE_CL` table. Run one of the sample queries above in Log Analytics to confirm data is flowing.
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
cybereinforce_cte
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC