Microsoft Azure Security Insights
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionoauth213 EndpointsREST
For Agents
Manage Microsoft Sentinel alert rules, automated rule actions, and data connectors that bring telemetry into a Log Analytics workspace.
Use for: Create a scheduled alert rule in Microsoft Sentinel for failed sign-ins, Attach a logic app playbook as an action on an alert rule, List all data connectors configured in a Sentinel workspace, Disable a noisy alert rule without deleting it
Not supported: Does not query raw log data, manage incidents, or run hunting queries — use for Sentinel alert rule, action, and data connector configuration only.
Jentic publishes the only available OpenAPI specification for Security Insights, keeping it validated and agent-ready. The Azure Security Insights API exposes the Microsoft.SecurityInsights resource provider that powers Microsoft Sentinel, the Azure-native SIEM. It lets agents manage scheduled and Microsoft-source alert rules, attach automated actions to those rules, and connect telemetry data sources such as Office 365, AAD, AWS CloudTrail, and threat intelligence feeds into a Log Analytics workspace. The API is workspace-scoped and is the same control plane the Microsoft Sentinel portal uses under the hood.
Install Jentic One Beta
Connect the Security Insights to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Security Insights, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Security Insights API.
Create scheduled alert rules that run KQL queries against Sentinel workspace data
Attach automated actions such as logic app playbooks to alert rules
Onboard data connectors for Office 365, Azure AD, AWS CloudTrail, and threat intelligence feeds
List the available Microsoft.SecurityInsights operations exposed in a region
Disable or re-enable a Sentinel alert rule without deleting it
Inspect the configuration of a connected data source attached to a workspace
Tune detection logic by updating an alert rule's query, severity, or trigger threshold
Use Cases
Patterns agents use Security Insights API for, with concrete tasks.
★ Detection-as-Code Deployment
Security engineering teams version-control their Sentinel detections and push them through CI rather than editing rules in the portal. The alertRules endpoint accepts the full rule definition — KQL query, query frequency, period, severity, and trigger threshold — so a pipeline or agent can deploy a catalogue of detections to one or many workspaces deterministically and roll forward when the query logic changes.
Create a scheduled alertRule in the workspace with a KQL query for repeated failed Azure AD sign-ins, severity High, query frequency PT5M, and triggerThreshold 5
SOAR Playbook Wiring
Security operations teams automate response by attaching Logic Apps to detections so that when a rule fires, an incident is enriched, a user disabled, or an analyst paged. The alertRules/{ruleId}/actions endpoint links a Logic App resource ID to a rule and lets an agent rotate or replace the playbook without touching the detection logic itself.
Create an action under alertRules/{ruleId}/actions that wires a Logic App resource ID to fire when the rule triggers
Multi-Tenant Connector Audit
MSSPs and central security teams audit which data sources are flowing into each customer or business unit workspace. The dataConnectors list endpoint returns every configured connector with its kind (Office365, AzureActiveDirectory, AmazonWebServicesCloudTrail, ThreatIntelligence, and others) so an agent can build a coverage report and flag workspaces missing critical telemetry.
List dataConnectors for the workspace and return the kind and dataTypes state for each connector
AI Agent SOC Triage
An agent built on Jentic uses Security Insights to inspect and tune detections during incident response. The agent can read the rule that fired, lower or raise its threshold, disable it during a known false-positive storm, and re-enable it once the underlying noise is fixed — all without an analyst opening the Sentinel UI.
Search Jentic for disable a sentinel alert rule, load the schema, and PATCH the rule to set enabled false for the next 24 hours
Key Endpoints
13 endpoints — jentic publishes the only available openapi specification for security insights, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules
List all alert rules in a Sentinel workspace
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}
Create or update a Sentinel alert rule
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}
Delete a Sentinel alert rule
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions/{actionId}
Attach a Logic App playbook action to a rule
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors
List configured data connectors for a workspace
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}
Onboard or update a data connector
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules
List all alert rules in a Sentinel workspace
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}
Create or update a Sentinel alert rule
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}
Delete a Sentinel alert rule
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions/{actionId}
Attach a Logic App playbook action to a rule
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors
List configured data connectors for a workspace
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}
Onboard or update a data connector
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD service principal secrets sit encrypted in the Jentic vault. The agent receives a short-lived bearer token scoped to user_impersonation, so raw client secrets never enter the agent context or chat transcript.
Intent-based discovery
Agents search Jentic by intent such as create a sentinel alert rule or onboard sentinel data connector and Jentic returns the matching Microsoft.SecurityInsights operation with its full input schema, ready to execute.
Time to first call
Direct integration with the Microsoft.SecurityInsights ARM endpoints: 1-3 days for AAD app registration, token exchange, and ARM error retries. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Security Insights API through Jentic.
Why is there no official OpenAPI spec for Security Insights?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Security Insights via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Security Insights API use?
Security Insights uses Azure AD OAuth 2.0 with the implicit flow against https://login.microsoftonline.com/common/oauth2/authorize and the user_impersonation scope. When called through Jentic, your service principal credentials sit in the Jentic vault and the agent only ever sees a short-lived bearer token scoped to the subscription it is acting on.
Can I create Microsoft Sentinel alert rules with this API?
Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId} accepts the rule kind (Scheduled or MicrosoftSecurityIncidentCreation), KQL query, query frequency, severity, and triggerThreshold. The same path supports DELETE to remove a rule.
How do I attach a Logic App playbook to an alert rule?
Use PUT /subscriptions/{subscriptionId}/.../alertRules/{ruleId}/actions/{actionId} with the Logic App resource ID and the trigger URI. The action becomes part of the rule and runs when the detection fires; you can replace it later by PUT-ing the same actionId with a different Logic App.
What are the rate limits for the Security Insights API?
Azure Resource Manager applies subscription-level throttling for both reads (around 12,000 per hour) and writes (around 1,200 per hour) per principal, surfaced in the x-ms-ratelimit-remaining-subscription-reads and x-ms-ratelimit-remaining-subscription-writes response headers. Jentic returns those headers so an agent can pace itself before hitting the cap.
How do I onboard a data connector through Jentic?
Search Jentic for onboard sentinel data connector, load the schema for PUT /.../dataConnectors/{dataConnectorId}, and execute it with the connector kind (for example AzureActiveDirectory or AmazonWebServicesCloudTrail) and the dataTypes block enabled. The full search, load, and execute flow ships in the Jentic Python SDK after pip install jentic.
Does this API let me read raw security events?
No — this API manages the Sentinel control plane (rules, actions, connectors). To query events you run KQL against the Log Analytics workspace through the Azure Monitor Logs query API. Use Security Insights to configure detections and use the Log Analytics query API to read what they produce.
GET STARTED