AirlockDigital

The [Airlock Digital](https://www.airlockdigital.com/) solution for Microsoft Sentinel ingests application control and execution logs from Airlock Digital using the Codeless Connector Platform (CCP), giving visibility into file executions, server activity, and policy changes. The solution provides three data connectors so you can choose the one that matches your deployment: a. **Airlock Digital (Push)** -- for self-hosted servers and Airlock Digital SaaS running v7.0 or higher. Airlock's external logging feature streams execution history, server activity, and policy change events into Microsoft Sentinel in near real time, authenticating with a Microsoft Entra application. This is the recommended connector. b. **Airlock Digital (Poll)** -- for self-hosted servers older than v7.0 that do not support push-based logging. Periodically pulls execution history and server activity from the Airlock REST API using a user API key. c. **Airlock Digital (Poll - SaaS)** -- for the Airlock Digital hosted SaaS offering, authenticating with a user API key together with your directory and tenant identifiers. The solution also installs ASIM parsers that normalize Airlock data into the Process Event and Audit Event schemas, plus a workbook summarizing application control activity. **Underlying Microsoft Technologies used:** This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: a. [Codeless Connector Platform (CCP)](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)