Blog Post

Microsoft Sentinel Blog
7 MIN READ

How to setup a Canarytoken and receive incident alerts on Azure Sentinel

Nathan Swift's avatar
Nathan Swift
Icon for Microsoft rankMicrosoft
Dec 08, 2020
With Azure Sentinel you can receive all sorts of security telemetry, events, alerts, and incidents from many different and unique sources. Those sources can be firewall logs, security events, audit l...
Updated Dec 08, 2020
Version 1.0
jlyon9's avatar
jlyon9
Copper Contributor
May 20, 2022

Excellent article. I had to make one change to the logicapp to get it to parse the token auth correctly. Open logic app designer, expand "Initialize variable TokenAuth" and value (fx) substring -> change number '38' to '37'

original = substring(body('Parse_JSON_Token_Response')?['manage_url'], 38)
new = substring(body('Parse_JSON_Token_Response')?['manage_url'], 37)
With the original value (38), it was truncating the first letter of the token. Setting to 37 fixes this issue.