ContraForce Sentinel Hunting Service Principal

This article provides an overview of the ContraForce Sentinel Hunting Service Service Principal.

ContraForce Sentinel Hunting

The ContraForce Sentinel Hunting service principal is used to call the Log Analytics API with the Data.Read scope. In the delegated, on-behalf-of flow, this allows the ContraForce Sentinel Hunting service principal to send direct queries to a Sentinel Workspace on behalf of the signed in user. We use this for providing deeper incident context via raw event/”evidence” logs, and for running queries from the Advanced Hunting Sentinel page.