Skip to main content
Aona
Book a demo
Solutions / Sentinel integration
On this page

For security teams and Microsoft Sentinel operators.

Bring employee AI security events into Microsoft Sentinel.

Investigate employee AI policy events alongside your existing security signals using Aona’s documented, customer-deployed API connector.

Book a Sentinel demo

Walk through event fields, the ingestion path and customer deployment requirements.

Trace a sample event
FOLLOW ONE SYNTHETIC EVENT

Source. Ingest. Investigate.

Select a stage to inspect it

Customer-deployed poller · five-minute schedule · validate event-volume limits.

EVENT TRACEPolicy violationBLOCKID ending 000001
Aona event
Logic App
Sentinel
{
  "id": "00000000-0000-4000-8000-000000000001",
  "class_uid": 6005,
  "type_name": "policy_violation",
  "disposition": "BLOCK"
}

BLOCK identifies this synthetic policy-violation event. The example does not prove an action was stopped.

Download synthetic JSON

Connector illustration, not a Sentinel screenshot. No live API calls or query execution.

Scope to confirmCustomer-deployed connector. Five-minute polling; event-volume limits must be validated.

Coverage and deployment details

This is a customer-deployed, API-based integration. The documented polling schedule is five minutes; actual availability depends on collection and processing.

The documented connector does not retrieve additional pages of events. Confirm event-volume limits and completeness before using it for investigations.

Sentinel receives evidence for investigation. Preventive controls run on supported employee AI workflows through Aona.

Built for your decision

Start with your SOC’s question.

Follow the evidence from an employee AI event to the investigation your security team needs to run.

SOC analysts

Investigate AI DLP events alongside existing signals

A SOC investigation needs context from an employee AI interaction.

Aona event
Customer-operatedLogic App · poll
Investigate

Illustrative one-way evidence path · validate deployment limits.

Keep in viewAn event is one piece of evidence, not a complete attack narrative.

Scenario details
Inspect
  • Event identifier
  • Timestamp
  • Disposition
Next decision

Compare the observation with your other investigation evidence.

Start with a concrete question about an employee AI interaction. Review the available event identifier, timestamp and disposition in Sentinel alongside your other investigation evidence. Treat the event as one observation, not as proof of an entire attack chain or a complete account of employee behaviour.

From evidence to a decision

Investigate AI DLP events in Microsoft Sentinel.

Start with a traceable event, not a dashboard total. Check the deployment prerequisites, follow the documented field mapping and use a specific investigation question to evaluate the integration.

WORKED EXAMPLE · SYNTHETICUnexecuted example
Synthetic event…000001
Customer-operated poller5-minute schedule
Saved query functionAona
Expected resultMapped fields
Event walkthrough
Reduced motion · choose a step

Illustrative timing is compressed, not real ingestion latency.

Inspection queryKQL · not run
Aona
| where EventOriginalUid == "00000000-0000-4000-8000-000000000001"
| project EventTime, EventOriginalUid,
  Disposition, EventResult, TargetAppName

Illustrative query. No live API call or Sentinel query was run.

Expected mapping · synthetic

Expected fields to inspect

Fixture sourceSaved-function fieldSynthetic value
source idEventOriginalUid…000001
timeEventTime2026-09-08 09:00Z
dispositionDispositionBLOCK
app.nameTargetAppNameAona

TargetAppName is “Aona”, not the employee’s AI provider.

The poller does not retrieve additional pages. Confirm completeness for your event volume. BLOCK is a synthetic state, not proof an action was stopped.

Deployment prerequisites and fixture notes

Before testing the integration

  • events:read API key
  • Sentinel-enabled Log Analytics workspace
  • Logic App poller and saved Aona function

The documented poller runs every five minutes. Validate collection, processing and event-volume limits before relying on investigation totals.

What this example establishes

A bounded field check for a synthetic Aona event, not a customer result or a Sentinel screenshot. Result counts assume both fixture records are loaded. The fixture excludes COMPLIANT; NO_POLICY is not a compliant or approved outcome.

Source references: Aona API and webhooks documentation and Microsoft KQL documentation.

Bring your Sentinel owner, expected event volume and one investigation question.

Use the demo checklist

How it works in Aona

Follow an event from Aona to Sentinel.

AonaIllustrative example

Aona · Events API · Synthetic excerpt

GET/v1/events
{
  "type_name": "policy_violation",
  "disposition": "BLOCK"
}

A BLOCK record alone does not prove an action was stopped.

Compliant records excluded.

01 / 04
Technical path details
01 / Aona · Events API

Select the source evidence

The documented /v1/events feed provides OCSF-aligned event metadata. Check the included dispositions and fields. Compliant records are excluded from this public API, so it is not a complete copy of every reporting view.

02 / Customer Logic App

Validate polling and volume

The inspected connector polls every five minutes and writes to AonaEvents_CL. It does not retrieve additional pages. Confirm completeness for your expected volume and validate processing latency in your environment.

03 / Microsoft Sentinel · Aona function

Check the mapped query result

Inspect EventOriginalUid, EventTime and Disposition. The parser deduplicates by event identifier. TargetAppName identifies Aona in this mapping; do not interpret it as the employee’s AI provider.

Make the demo useful

A practical Microsoft Sentinel AI security integration checklist

Bring a sample investigation question and the Sentinel owner. The evaluation should test a traceable event path and its operating limits, not only display a successful connection.

Bring to the conversation
01Your Sentinel owner
02One investigation question
03The deployment prerequisites
Event semanticsWhich fields answer our investigation question?
What to inspect

Event identity, time, disposition and available context.

Ingestion completenessWhat happens when event volume exceeds one response?
What to inspect

API response limits and the connector’s pagination behaviour.

Mapping and duplicatesDoes the same event retain its identity across the path?
What to inspect

The raw table and the Aona query function.

OperationsWho detects and investigates a collection gap?
What to inspect

Access ownership, polling and ingestion checks.

Walk through event fields, the ingestion path and customer deployment requirements.

Book a Sentinel demo

A closer look

Your Sentinel integration questions, answered.

Your use case. Your demo.

Connect the event to your SOC’s workflow.

Bring the investigation you want to support. We’ll walk through the documented event path, query fields and deployment requirements with your security or Sentinel owner.

Book a Sentinel demo
What we’ll cover
  • Your investigation use case
  • The API and connector path
  • Event fields and query mapping
  • Deployment and operating ownership
Workforce AI security
Employee AI Security Events for Microsoft Sentinel | Aona