What this module adds: Sentinel incident ingestion, the workspace’s Content Management System (CMS) for detection rules, email notifications, log search, and Azure Lighthouse cross-tenant management.
Who is this for? Workspace Owners deploying the Sentinel module from the Modules tab of a workspace in the ContraForce portal.
Prerequisites
Before starting, ensure you have the following:Admin Role
Global Administrator or Privileged Role Administrator — either can grant admin consent for ContraForce enterprise applications (service principals). Cloud Application Administrator and Application Administrator cannot grant consent for Microsoft Graph application permissions.
Workspace Role
ContraForce Workspace Role: Owner
Subscription Owner
Microsoft Subscription Permission: Owner — required to deploy the supporting Azure infrastructure
Additional Requirements
What Gets Deployed
When you deploy the Sentinel module, ContraForce automatically provisions the Azure resources needed for integration. You do not deploy Lighthouse or the streaming infrastructure as separate manual steps — they are created as part of module deployment.Azure Resources Reference
Complete list of all deployed resources with details
Step 1: Open the Modules Tab
1
Open Your Workspace
Sign in at portal.contraforce.com, open the Workspace Center, and select the workspace you want to configure.
2
Go to the Modules Tab
Open the workspace and select the Modules tab. This is where every module is enabled and consented.
3
Locate Microsoft Sentinel
Find the Microsoft Sentinel module in the list of available modules.
Step 2: Verify Prerequisites
Before deploying, confirm you hold the required roles. The deployment will not complete without them.If you’re missing any of these, obtain the required permissions before proceeding. The deployment will fail without proper access.
Step 3: Consent the Microsoft Sentinel Module
Consent is a single action per module on the Modules tab. Clicking Consent grants everything ContraForce needs for this module in one step.1
Click Consent
On the Microsoft Sentinel module, click Consent.
2
Sign In as Global Administrator
A Microsoft consent window opens. Sign in with Global Administrator credentials.
3
Accept Permissions
Review the requested permissions and click Accept to consent on behalf of your organization.
4
Deploy the Supporting Azure Infrastructure
Consenting the module automatically deploys the supporting Azure resources — Azure Lighthouse delegation, the Apollo resource group, and the Sentinel-side Logic App and automation rule. You may be prompted to sign in with an account that has Subscription Owner permissions so the resources can be created.
Apollo resources are created in the customer’s Azure subscription. Standard Azure charges may apply for Logic App executions.
What the Sentinel Module Grants
Resources Created in Your Subscription
Threat Hunting Permissions
The Sentinel module grants the ContraForce Sentinel Hunting application read access to your Log Analytics data.Sentinel Hunting Application
Enterprise application details and permissions
Step 4: Verify Module Status
A workspace module is live when its status indicator turns green on its card. Confirm the Sentinel module is fully deployed:- Microsoft Sentinel module status light shows green
- Sentinel incidents begin streaming into the Command Dashboard
Test Incident Sync
1
Open the Command Dashboard
Navigate to the Command Dashboard in ContraForce.
2
Check for Sentinel Incidents
Look for incidents with the Sentinel source indicator.
3
Verify Incident Details
Click an incident to confirm entity enrichment and details are loading.
Post-Deployment Steps
Configure Notifications
With the Sentinel module active, you can now configure email notifications:1
Go to Notifications Settings
Navigate to workspace Settings → Notifications.
2
Enable Severity Filters
Select which severity levels should trigger notifications.
3
Save Settings
Click Save to apply your notification preferences.
Notifications Configuration
Complete guide to notification setup
Deploy Detection Rules
Manage this workspace’s analytics rules in its Content Management System (CMS):1
Open the CMS
Open Workspaces → [workspace] → Modules and select the flask icon on Microsoft Sentinel. The flask icon on the workspace’s card in the Workspace Center opens the same page.
2
Review the Rules
The Detection Rules page opens on the Sentinel Analytical Rules tab. Filter by severity and status, or search by name.
3
Add or Change Rules
Select Add rule to create an analytics rule, or select rules and use Actions to enable, disable, or delete them in bulk.
Content Management System
Manage a workspace’s Sentinel analytics rules and Defender custom detections
Troubleshooting
Common Issues
Verifying Azure Resources
To verify resources deployed correctly:1
Open Azure Portal
Navigate to portal.azure.com.
2
Check Resource Group
Search for the Apollo resource group (cf-apollo-[workspace]).
3
Verify Logic App
Confirm the Logic App exists and is Enabled.
4
Check Automation Rule
In Sentinel, go to Automation → Automation Rules and verify the ContraForce rule exists.
Lighthouse Troubleshooting
If Lighthouse delegation fails:- Check Azure Policy — Some organizations restrict Lighthouse delegations
- Remove existing delegations — Conflicting delegations can cause failures
- Verify permissions — Subscription Owner is required
- Check tenant settings — Ensure cross-tenant access isn’t blocked
How to remove existing Lighthouse delegation
How to remove existing Lighthouse delegation
- Go to Azure Portal → Service providers
- Find any existing ContraForce delegations
- Click on the delegation and select Delete
- Wait for deletion to complete
- Retry the deployment in ContraForce
How to enable Logic App manually
How to enable Logic App manually
- Go to Azure Portal → Resource Groups
- Open the cf-apollo-[workspace] resource group
- Click on the Logic App resource
- Click Enable if the Logic App is disabled
- Verify the Logic App shows “Enabled” status
Module Capabilities Unlocked
With the Sentinel module deployed, you now have access to:Sentinel Incidents
Real-time incident ingestion from Microsoft Sentinel
Email Notifications
Instant alerts when new incidents are created
Content Management System
Manage the workspace’s Sentinel analytics rules
Log Search
Query Log Analytics for threat hunting
Cross-Tenant Management
Manage multiple Sentinel workspaces from one portal
Advanced Threat Hunting
Execute KQL queries across customer environments
Next Steps
Configure Notifications
Set up email alerts for incidents
Deploy Detection Rules
Deploy rules from a content repository
Add Users
Grant team access in Settings → User Management
Incident Management
Start triaging Sentinel incidents
Related Guides
Defender Module
Defender for Endpoint integration
Azure Resources
Complete resource reference
Content Management Center
Detection rule management
Incident Deduplication
How duplicate Sentinel and Defender XDR incidents are kept out of your queue
Need help with Sentinel module deployment? Contact us at support@contraforce.com.