Security Insights

Name: Security Insights API
Brand: Security Insights
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionoauth213 EndpointsREST

For Agents

Manage Microsoft Sentinel alert rules, automated rule actions, and data connectors that bring telemetry into a Log Analytics workspace.

Connect the Security Insights to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Security Insights, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Security Insights API.

Create scheduled alert rules that run KQL queries against Sentinel workspace data

Attach automated actions such as logic app playbooks to alert rules

Onboard data connectors for Office 365, Azure AD, AWS CloudTrail, and threat intelligence feeds

List the available Microsoft.SecurityInsights operations exposed in a region

GET STARTED

Start building with Security Insights API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Security Insights, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Security Insights, keeping it validated and agent-ready. The Azure Security Insights API exposes the Microsoft.SecurityInsights resource provider that powers Microsoft Sentinel, the Azure-native SIEM. It lets agents manage scheduled and Microsoft-source alert rules, attach automated actions to those rules, and connect telemetry data sources such as Office 365, AAD, AWS CloudTrail, and threat intelligence feeds into a Log Analytics workspace. The API is workspace-scoped and is the same control plane the Microsoft Sentinel portal uses under the hood.

Use Cases

Patterns agents use Security Insights API for, with concrete tasks.

★ Detection-as-Code Deployment

Security engineering teams version-control their Sentinel detections and push them through CI rather than editing rules in the portal. The alertRules endpoint accepts the full rule definition — KQL query, query frequency, period, severity, and trigger threshold — so a pipeline or agent can deploy a catalogue of detections to one or many workspaces deterministically and roll forward when the query logic changes.

Create a scheduled alertRule in the workspace with a KQL query for repeated failed Azure AD sign-ins, severity High, query frequency PT5M, and triggerThreshold 5

SOAR Playbook Wiring

Security operations teams automate response by attaching Logic Apps to detections so that when a rule fires, an incident is enriched, a user disabled, or an analyst paged. The alertRules/{ruleId}/actions endpoint links a Logic App resource ID to a rule and lets an agent rotate or replace the playbook without touching the detection logic itself.

Create an action under alertRules/{ruleId}/actions that wires a Logic App resource ID to fire when the rule triggers

Multi-Tenant Connector Audit

MSSPs and central security teams audit which data sources are flowing into each customer or business unit workspace. The dataConnectors list endpoint returns every configured connector with its kind (Office365, AzureActiveDirectory, AmazonWebServicesCloudTrail, ThreatIntelligence, and others) so an agent can build a coverage report and flag workspaces missing critical telemetry.

List dataConnectors for the workspace and return the kind and dataTypes state for each connector

AI Agent SOC Triage

An agent built on Jentic uses Security Insights to inspect and tune detections during incident response. The agent can read the rule that fired, lower or raise its threshold, disable it during a known false-positive storm, and re-enable it once the underlying noise is fixed — all without an analyst opening the Sentinel UI.

Search Jentic for disable a sentinel alert rule, load the schema, and PATCH the rule to set enabled false for the next 24 hours

Key Endpoints

13 endpoints — jentic publishes the only available openapi specification for security insights, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules

List all alert rules in a Sentinel workspace

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}

Create or update a Sentinel alert rule

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}

Delete a Sentinel alert rule

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions/{actionId}

Attach a Logic App playbook action to a rule

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors

List configured data connectors for a workspace

PUT

Onboard or update a data connector

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules

List all alert rules in a Sentinel workspace

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}

Create or update a Sentinel alert rule

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}

Delete a Sentinel alert rule

PUT

Attach a Logic App playbook action to a rule

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD service principal secrets sit encrypted in the Jentic vault. The agent receives a short-lived bearer token scoped to user_impersonation, so raw client secrets never enter the agent context or chat transcript.

Intent-based discovery

Agents search Jentic by intent such as create a sentinel alert rule or onboard sentinel data connector and Jentic returns the matching Microsoft.SecurityInsights operation with its full input schema, ready to execute.

Time to first call

Direct integration with the Microsoft.SecurityInsights ARM endpoints: 1-3 days for AAD app registration, token exchange, and ARM error retries. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure Security Center

CSPM controls and Defender plans that feed alerts into Sentinel

Use Security Center when the agent needs to tune Defender pricing or compliance configuration rather than the SIEM detections themselves

Alternative

Amazon GuardDuty

AWS-native threat detection service

Use GuardDuty when the workload is in AWS and Sentinel is not the SIEM target

Alternative

AWS Security Hub

AWS-native findings aggregator across security services

Use Security Hub when consolidating AWS findings rather than running Sentinel detections

FAQs

Specific to using Security Insights API through Jentic.

Why is there no official OpenAPI spec for Security Insights?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Security Insights via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Security Insights API use?

Security Insights uses Azure AD OAuth 2.0 with the implicit flow against https://login.microsoftonline.com/common/oauth2/authorize and the user_impersonation scope. When called through Jentic, your service principal credentials sit in the Jentic vault and the agent only ever sees a short-lived bearer token scoped to the subscription it is acting on.

Can I create Microsoft Sentinel alert rules with this API?

Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId} accepts the rule kind (Scheduled or MicrosoftSecurityIncidentCreation), KQL query, query frequency, severity, and triggerThreshold. The same path supports DELETE to remove a rule.

How do I attach a Logic App playbook to an alert rule?

Use PUT /subscriptions/{subscriptionId}/.../alertRules/{ruleId}/actions/{actionId} with the Logic App resource ID and the trigger URI. The action becomes part of the rule and runs when the detection fires; you can replace it later by PUT-ing the same actionId with a different Logic App.

What are the rate limits for the Security Insights API?

Azure Resource Manager applies subscription-level throttling for both reads (around 12,000 per hour) and writes (around 1,200 per hour) per principal, surfaced in the x-ms-ratelimit-remaining-subscription-reads and x-ms-ratelimit-remaining-subscription-writes response headers. Jentic returns those headers so an agent can pace itself before hitting the cap.

How do I onboard a data connector through Jentic?

Search Jentic for onboard sentinel data connector, load the schema for PUT /.../dataConnectors/{dataConnectorId}, and execute it with the connector kind (for example AzureActiveDirectory or AmazonWebServicesCloudTrail) and the dataTypes block enabled. The full search, load, and execute flow ships in the Jentic Python SDK after pip install jentic.

Does this API let me read raw security events?

No — this API manages the Sentinel control plane (rules, actions, connectors). To query events you run KQL against the Log Analytics workspace through the Azure Monitor Logs query API. Use Security Insights to configure detections and use the Log Analytics query API to read what they produce.