Halcyon Connector (v2)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | HalcyonPushV2 |
| Publisher | Halcyon |
| Used in Solutions | Halcyon |
| Collection Method | CCF Push |
| Connector Definition Files | Halcyon_connectorDefinition.json |
| DCR Definition Files | Halcyon_DCR.json |
| CCF Configuration | Halcyon_dataConnector.json |
| CCF Capabilities | Push |
| Ingestion API | Log Ingestion API — CCF Push connectors use DCR-based Log Ingestion API |
| Microsoft Learn | View on Learn |
The Halcyon connector provides the capability to send data from Halcyon to Microsoft Sentinel. This v2 connector ingests Halcyon Events into HalcyonEventsV2_CL and Alert Updates into HalcyonAlertUpdatesV2_CL.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
HalcyonAlertUpdatesV2_CL |
? | ✓ | ? |
HalcyonEventsV2_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace Permissions (Workspace): Read and Write permissions are required.
Custom Permissions:
- Microsoft Entra Create Permissions: Permissions to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher.
- Role Assignment Permissions: Write permissions required to assign Monitoring Metrics Publisher role to the data collection rule (DCR). Typically requires Owner or User Access Administrator role at the resource group level.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Create ARM Resources and Provision Required Permissions
Clicking "Deploy" creates the Log Analytics tables (HalcyonEventsV2_CL and HalcyonAlertUpdatesV2_CL) and a Data Collection Rule (DCR), then creates an Entra application linked to the DCR and provisions the required permissions. Once configured, Halcyon pushes Events and Alert Updates to the DCR endpoint, ingesting them into the HalcyonEventsV2_CL and HalcyonAlertUpdatesV2_CL tables.
Automated Configuration and Secure Data Ingestion with Entra Application
Clicking on "Deploy" will trigger the creation of Log Analytics tables and a Data Collection Rule (DCR). It will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token. Deploy Halcyon Connector Resources
2. Configure your integration in the Halcyon Platform
Use the following parameters to configure your integration in the Halcyon Platform.
- Directory ID (Tenant ID):
TenantIdNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Entra App Registration Application ID (Client ID):
ApplicationIdNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Entra App Registration Secret (Credential Secret) (THIS SECRET WILL NOT BE VISIBLE AFTER LEAVING THIS PAGE):
ApplicationSecretNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Data Collection Endpoint (URL):
DataCollectionEndpointNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Data Collection Rule ID (Rule ID):
DataCollectionRuleIdNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊