← All integrationsINTEGRATION · SECURITY OPERATIONS

Kapālins for Microsoft Sentinel

Your SOC keeps working in Microsoft Sentinel. Kapālins pushes every AI finding, block and incident there as the Log Analytics data collector endpoint, into a custom table (KapalinsAIEvents_CL by default) your analytics rules and workbooks query by name, with the person, the rule and the evidence on each one.

See it governed liveSetup in four steps

No new console for the SOC

Analysts triage AI findings in Microsoft Sentinel, next to everything else, in its own field names.

AI-specific signal you do not have today

Prompt injection, sensitive data in prompts, unapproved models and agent tool calls, mapped to MITRE ATLAS before they arrive.

Every finding once

Deduplicated on the Kapālins event id, so a retry never doubles a ticket, and every attempt is in the push log.

WHAT ARRIVES

What lands in Microsoft Sentinel.

Each incident carries its severity, the person, the rule that fired, what was stopped, and a link back to the evidence. "Ship to ITSM" on the card sends it on demand; findings you choose are pushed as they happen.

  • Sent as the Log Analytics data collector endpoint, into a custom table (KapalinsAIEvents_CL by default) your analytics rules and workbooks query by name
  • Credential: the workspace id and shared key
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
CONTEXT

Mapped to the attack. Priced in dollars.

Every finding carries the MITRE ATLAS technique it belongs to and the plane that caught it. Click the technique and Kapālins shows its residual risk and a modelled annual loss, so the SOC can rank AI findings by what they could cost.

  • Bayesian FAIR on your own telemetry, labelled as modelled
  • Prompt injection, jailbreak, tool misuse, data exfiltration
Kapālins Threat Map: a MITRE ATLAS technique opened to its modelled loss exposure
Console replay · illustrative data
A replay of the Kapālins console: posture, the MITRE ATLAS matrix, then one technique opened to its residual risk and a modelled annual loss from Bayesian FAIR with sector priors. Loss figures are modelled; key names are illustrative.
SOURCE

Everything behind the finding.

The full record stays in Kapālins: the request, the verdict and the rule, so an analyst in your SIEM can pivot to the evidence.

  • Nothing is pulled from your SIEM
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
Setup

Four steps.

  1. Create the destination credentialThe workspace id and shared key, created in Microsoft Sentinel.
  2. Add the destinationSecurity operations › Microsoft Sentinel › paste the credential and endpoint.
  3. Choose what to pushFindings, blocks or incidents, with a minimum severity.
  4. Send a testKapālins pushes a test event and shows the response.
Request a briefing

See Microsoft Sentinel governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins read anything from Microsoft Sentinel?

No. The integration is one-way: Kapālins pushes, nothing is pulled.

Can I limit what is pushed?

Yes. Choose the finding types and the minimum severity; the rest stays in Kapālins.

What if a push fails?

The attempt and the response are recorded in the push log and shown on the integration; the next attempt retries it.