Blog Post

Microsoft Sentinel Blog
7 MIN READ

How to setup a Canarytoken and receive incident alerts on Azure Sentinel

Nathan Swift's avatar
Nathan Swift
Icon for Microsoft rankMicrosoft
Dec 08, 2020
With Azure Sentinel you can receive all sorts of security telemetry, events, alerts, and incidents from many different and unique sources. Those sources can be firewall logs, security events, audit l...
Updated Dec 08, 2020
Version 1.0
Nathan Swift's avatar
Icon for Microsoft rankMicrosoft
Joined October 09, 2018
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

When evaluating various solutions, your peers value hearing from people like you who’ve used the product. Review Microsoft Sentinel by filling out a Gartner Peer Insights survey and receive a $25 USD gift card (for customers only). Here are the Privacy/Guideline links: Microsoft Privacy Statement, Gartner’s Community Guidelines & Gartner Peer Insights Review Guide.

jlyon9's avatar
jlyon9
Copper Contributor
May 20, 2022

Excellent article. I had to make one change to the logicapp to get it to parse the token auth correctly. Open logic app designer, expand "Initialize variable TokenAuth" and value (fx) substring -> change number '38' to '37'

original = substring(body('Parse_JSON_Token_Response')?['manage_url'], 38)
new = substring(body('Parse_JSON_Token_Response')?['manage_url'], 37)
With the original value (38), it was truncating the first letter of the token. Setting to 37 fixes this issue.