Behaviour signals
Keepnet + Microsoft Sentinel integration
Use the alerts your SOC already triages as behaviour signals.
Signals in
Keepnet integrates with Microsoft Sentinel to use the alerts your SOC already triages as behaviour signals.
What you get
- Sentinel alerts linked to employees
- No new pipeline for your SOC to run
- Signals appear in the Secure Behaviour Dashboard
How it works
- Keepnet reads the SecurityAlert table in your Log Analytics workspace
- Alerts are matched to employees
- The behaviour is recorded with a severity
Data and permissions
| Data | Direction | Detail |
|---|---|---|
| SecurityAlert table | In | Read only (Log Analytics Reader on the workspace) |
What you need
- A Log Analytics workspace with Sentinel
- Read access for the Keepnet app
Set up
Add the workspace ID and grant read access.
Related integrations
- Works with
- Secure Behaviour Dashboard, Agentic AI
- Built by
- Keepnet
- Last updated
- October 2026
