What this module adds: Sentinel incident ingestion, Content Management System (CMS) for detection rules, email notifications, log search, and Azure Lighthouse cross-tenant management.
Who is this for? Workspace Admins and Data Source Admins deploying the Sentinel module from the Modules tab of a workspace in the ContraForce portal.
Prerequisites
Before starting, ensure you have the following:Admin Role
Global Administrator — required to grant admin consent for ContraForce enterprise applications (service principals). Cloud Application Administrator and Application Administrator cannot grant consent for Microsoft Graph application permissions.
Workspace Role
ContraForce Workspace Role: Owner or Admin
Subscription Owner
Microsoft Subscription Permission: Owner — required to deploy the supporting Azure infrastructure
Additional Requirements
| Requirement | Details |
|---|---|
| Microsoft Sentinel | Active Sentinel workspace in your Azure subscription |
| Log Analytics Workspace | The workspace linked to your Sentinel deployment |
| Resource Group Access | Ability to create resources in the subscription |
| No Conflicting Policies | Azure Policy must allow Lighthouse delegations |
What Gets Deployed
When you deploy the Sentinel module, ContraForce automatically provisions the Azure resources needed for integration. You do not deploy Lighthouse or the streaming infrastructure as separate manual steps — they are created as part of module deployment.| Component | Purpose |
|---|---|
| Azure Lighthouse | Cross-tenant delegation for multi-tenant management |
| Apollo Resource Group | Infrastructure for incident streaming |
| Logic App | Streams Sentinel incidents to ContraForce in real-time |
| Automation Rule | Triggers the Logic App when incidents are created/updated |
| Role Assignments | Grants ContraForce service principals access to Sentinel |
Azure Resources Reference
Complete list of all deployed resources with details
Step 1: Open the Modules Tab
Open Your Workspace
Sign in at portal.contraforce.com, open the Workspace Center, and select the workspace you want to configure.
Go to the Modules Tab
Open the workspace and select the Modules tab. This is where every module is enabled and consented.
Step 2: Verify Prerequisites
Before deploying, confirm you hold the required roles. The deployment will not complete without them.| Prerequisite | Required Value |
|---|---|
| Azure Role for Microsoft Tenant | Global Administrator |
| ContraForce Workspace Role | Owner or Admin |
| Microsoft Subscription Permission | Owner |
If you’re missing any of these, obtain the required permissions before proceeding. The deployment will fail without proper access.
Step 3: Consent the Microsoft Sentinel Module
Consent is a single action per module on the Modules tab. Clicking Consent grants everything ContraForce needs for this module in one step.Sign In as Global Administrator
A Microsoft consent window opens. Sign in with Global Administrator credentials.
Accept Permissions
Review the requested permissions and click Accept to consent on behalf of your organization.
Deploy the Supporting Azure Infrastructure
Consenting the module automatically deploys the supporting Azure resources — Azure Lighthouse delegation, the Apollo resource group, and the Sentinel-side Logic App and automation rule. You may be prompted to sign in with an account that has Subscription Owner permissions so the resources can be created.
Apollo resources are created in the customer’s Azure subscription. Standard Azure charges may apply for Logic App executions.
What the Sentinel Module Grants
| Capability | Description |
|---|---|
| Cross-tenant visibility | View and manage Sentinel from the ContraForce portal |
| Incident access | Read and update incidents across tenants |
| Query execution | Run Log Analytics queries for threat hunting |
| Rule deployment | Deploy detection rules via CMS |
Resources Created in Your Subscription
| Resource | Type | Purpose |
|---|---|---|
| cf-apollo-[workspace] | Resource Group | Container for streaming resources |
| cf-incident-stream | Logic App | Processes and forwards incidents |
| cf-sentinel-connection | API Connection | Authenticates to Sentinel |
| cf-incident-trigger | Automation Rule | Triggers on incident changes |
Threat Hunting Permissions
The Sentinel module grants the ContraForce Sentinel Hunting application read access to your Log Analytics data.| Application | Permissions | Purpose |
|---|---|---|
| ContraForce Sentinel Hunting | Log Analytics Reader | Execute KQL queries for threat hunting |
Sentinel Hunting Application
Enterprise application details and permissions
Step 4: Verify Module Status
A workspace module is live when its status indicator turns green on its card. Confirm the Sentinel module is fully deployed:- Microsoft Sentinel module status light shows green
- Sentinel incidents begin streaming into the Command Dashboard
Test Incident Sync
Post-Deployment Steps
Configure Notifications
With the Sentinel module active, you can now configure email notifications:Notifications Configuration
Complete guide to notification setup
Deploy Detection Rules
Use the Content Management System to deploy detection rules to your Sentinel workspace:CMS Onboarding
Deploy detection rules to your Sentinel workspace
Troubleshooting
Common Issues
| Issue | Cause | Solution |
|---|---|---|
| Subscription not visible | Insufficient permissions | Sign in with a Subscription Owner account |
| Deployment fails | Azure Policy restrictions | Check for policies blocking Lighthouse or resource creation |
| Lighthouse delegation fails | Existing delegation | Remove the existing Lighthouse delegation and retry |
| Consent fails | Insufficient role | Grant consent with Global Administrator credentials |
| No incidents appearing | No incidents in Sentinel | Verify incidents exist in the Sentinel portal |
| Apollo Logic App disabled | Deployment issue | Manually enable the Logic App in the Azure portal |
| Consent popup blocked | Browser settings | Allow popups from portal.contraforce.com |
Verifying Azure Resources
To verify resources deployed correctly:Open Azure Portal
Navigate to portal.azure.com.
Lighthouse Troubleshooting
If Lighthouse delegation fails:- Check Azure Policy — Some organizations restrict Lighthouse delegations
- Remove existing delegations — Conflicting delegations can cause failures
- Verify permissions — Subscription Owner is required
- Check tenant settings — Ensure cross-tenant access isn’t blocked
How to remove existing Lighthouse delegation
How to remove existing Lighthouse delegation
- Go to Azure Portal → Service providers
- Find any existing ContraForce delegations
- Click on the delegation and select Delete
- Wait for deletion to complete
- Retry the deployment in ContraForce
How to enable Logic App manually
How to enable Logic App manually
- Go to Azure Portal → Resource Groups
- Open the cf-apollo-[workspace] resource group
- Click on the Logic App resource
- Click Enable if the Logic App is disabled
- Verify the Logic App shows “Enabled” status
Module Capabilities Unlocked
With the Sentinel module deployed, you now have access to:Sentinel Incidents
Real-time incident ingestion from Microsoft Sentinel
Email Notifications
Instant alerts when new incidents are created
Content Management System
Deploy and manage detection rules at scale
Log Search
Query Log Analytics for threat hunting
Cross-Tenant Management
Manage multiple Sentinel workspaces from one portal
Advanced Threat Hunting
Execute KQL queries across customer environments
Next Steps
Configure Notifications
Set up email alerts for incidents
Deploy Detection Rules
Use CMS to deploy Sentinel rules
Add Users
Grant team access in Settings → User Management
Incident Management
Start triaging Sentinel incidents
Related Guides
Defender Module
Defender for Endpoint integration
Azure Resources
Complete resource reference
CMS Overview
Detection rule management
Need help with Sentinel module deployment? Contact us at support@contraforce.com.