Deliverd

Microsoft Sentinel

Bring your Deliverd audit log into Microsoft Sentinel, with analytics rules and a workbook, in one deployment.

Your security team already watches Sentinel. The Deliverd solution puts your organisation's audit log there too: every approval asked for and decided, every policy gate allowed, refused or sent to a person, what an agent reported doing with a permission, and changes to policy, tokens, members, evidence and legal holds. Each entry keeps its place in Deliverd's hash chain, so what Sentinel holds can be checked against Deliverd's own record.

What it installs

PieceWhat it does
DeliverdAudit_CL tableOne row per audit entry, with the actor, what it was about, the event details and the hash chain columns.
Deliverd audit log connectorA codeless connector that reads GET /api/v1/audit-events every five minutes, 200 entries a page, with your token.
Four analytics rulesAn agent reported an act its permission did not cover (High); an agent refused by policy repeatedly (Medium); a token used beyond its scopes (Medium); policy, evidence or legal hold changes (Low).
WorkbookApprovals by outcome, gate decisions over time, the actions refused most, who decides, and acts refused after the fact.

Before you start

  • A Log Analytics workspace with Microsoft Sentinel turned on.
  • Contributor on the workspace's resource group, or Microsoft Sentinel Contributor plus Monitoring Contributor.
  • A Deliverd API token. Create it under Settings → API tokens while signed in as an owner, administrator or security administrator. The audit log is never readable with an agent key.

Install

  1. 1

    Open the deployment

    Press Deploy to Azure below. The Azure portal opens a custom deployment of Deliverd's template.

  2. 2

    Fill in the form

    Pick the subscription and the resource group your workspace is in, then enter the workspace name, your Deliverd address (shown beside the button) and the token. Azure keeps the token as a secure value, not readable after deployment. Leave Enable analytics rules on, or turn it off to review the rules first under Analytics.

  3. 3

    Create

    The deployment creates the table, a data collection endpoint and rule, the connector with your organisation already connected, the rules and the workbook. Data can take up to 30 minutes to appear the first time.

  4. 4

    Check

    In Sentinel, open Data connectors → Deliverd audit log; it shows as connected. Run DeliverdAudit_CL | take 10 under Logs to see the first entries.

Deploy to Azure ↗ — opens a custom deployment in the Azure portal. Your Deliverd address is deliverd.dev.

For the security review

  • Sentinel pulls; Deliverd never pushes into your tenant and holds no Azure credential.
  • The token is read-only for the audit log and acts as the person who created it. Revoke it under Settings → API tokens and the connector stops.
  • The template holds no secret and is the same for every organisation. It is served from /api/integrations/sentinel/azuredeploy.json because the Azure portal fetches templates from the browser.