OpenAI (via Codeless Connector Framework)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | OpenAIConnector |
| Publisher | Microsoft |
| Used in Solutions | OpenAI |
| Collection Method | CCF |
| Connector Definition Files | OpenAI_ConnectorDefinition.json |
| DCR Definition Files | OpenAI_DCR.json |
| CCF Configuration | OpenAI_PollingConfig.json |
| CCF Capabilities | APIKey, Paging |
| Microsoft Learn | View on Learn |
The OpenAI data connector enables you to ingest audit logs, chat completion data, or both from your OpenAI organization into Microsoft Sentinel through the OpenAI API. Each data type uses a separate REST API poller and requires a different API key type: audit logs (user actions, API key management, organization changes, security events) require an organization-level admin API key, while chat completions (model usage, token consumption, performance metrics) require a project-level API key. You may configure one or both data types independently. Audit logs are collected into the custom OpenAIAuditLogs_CL table (aliased by the OpenAIAuditLogs parser). Chat completions are normalized into the ASimAgentEventLogs standard ASIM table (aliased by the OpenAIChatCompletions parser) for security monitoring, compliance analysis, and usage monitoring. Refer to OpenAI API documentation for more information.
Tables Ingested
This connector ingests data into the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
ASimAgentEventLogs |
EventProduct == "OpenAI API Platform"EventType == "ChatCompletion"EventVendor == "OpenAI" |
? | ✗ | ? |
OpenAIAuditLogs_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Custom Permissions:
- OpenAI API access: Each data type requires a different API key type. An organization-level admin API key is required for audit logs - these can be created in your OpenAI organization settings. A project-level API key is required for chat completions - these can be created under a specific project in the OpenAI dashboard. You may configure audit logs, chat completions, or both independently.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connection Information
Details on the connections used to collect data from OpenAI's API.
- Audit Logs (
OpenAIAuditLogs):- Use organization-level admin API keys.
- Audit logging must be enabled in your OpenAI organization settings. Organization owners can go to OpenAI's
Organization settings->Data controls->Data retentionto enable audit logging. - Once OpenAI audit logging is enabled, it cannot be disabled without contacting OpenAI support.
- Chat Completions (
ASimAgentEventLogs):- Use project-level API keys.
- Only chat completions created with the
storeparameter set totruewill be collected. - Chat completions are normalized into the ASimAgentEventLogs ASIM standard table.
- Deleting stored chat completions while this connector is active may require you to disconnect and reconnect to reset the data collection state.
2. Add OpenAI Audit Logs Connection
Enter your OpenAI API credentials to collect audit logs data from OpenAI API. Add OpenAI Audit Logs Connection
Connect to OpenAI Audit Logs API
When you click the "Add Connection" button in the portal, a configuration form will open. You'll need to provide:
OpenAI Audit Logs Connection
Configure your OpenAI organization-level admin API key to collect audit logs (user actions, API key management, organization changes, security events).
Note: Audit logs require an organization-level admin API key. These can be created in your OpenAI organization settings.
- Audit Logs Connection Name (optional): e.g. My OpenAI Org - Audit Logs
- Organization API Key (required): Enter your OpenAI organization-level admin API key
💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.
3. Add OpenAI Chat Completions Connection
Enter your OpenAI API credentials to collect chat completions data from OpenAI API. Add OpenAI Chat Completions Connection
Connect to OpenAI Chat Completions API
When you click the "Add Connection" button in the portal, a configuration form will open. You'll need to provide:
OpenAI Chat Completions Connection
Configure your OpenAI project-level API key to collect chat completions data (model usage, token consumption, performance metrics) into the ASimAgentEventLogs ASIM standard table.
Note: Chat completions require a project-level API key. These can be created under a specific project in the OpenAI dashboard. Only chat completions created with the
storeparameter set totruewill be collected.
- Chat Completions Connection Name (optional): e.g. My OpenAI Project - Chat Completions
- Project API Key (required): Enter your OpenAI project-level API key
💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.
Connector Management Interface
This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.
📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:
- Friendly Name
- Alias
- URL
➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).
🔧 Manage Collectors: Use the actions menu to delete or modify existing collectors.
💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊