Azure Data Explorer

The Dropzone platform integrates with Azure Data Explorer (Kusto) so analysts can investigate organization-specific logs and telemetry that may not exist in Sentinel or Defender.

Dropzone uses your Microsoft Entra service principal to authenticate to one or more ADX clusters, discover available databases and tables, and execute read-only KQL queries. The ADX scanner builds table metadata (descriptions, fields, and query guidance) so the assistant can choose relevant tables and generate better queries.

Integration Overview

To enable these integrations you will perform the following actions:

• Register a new application in Microsoft Entra Admin Center
• Locate your Client ID, Tenant ID, and create a Client Secret
• Assign Azure Data Explorer permissions for your service principal
• Collect your ADX Cluster URL(s)
• Install the credentials into your Dropzone tenant
• Run the scanner to discover ADX tables and schemas

See the Microsoft Integrations page for instructions on how to register a new application, locate your Client ID and Tenant ID, and create a Client Secret.

{% hint style="info" %} When registering the application, set the "Supported account types" to "Accounts in this organizational directory only" and leave "Redirect URI" blank. No Microsoft Graph API permissions are required for this integration. {% endhint %}

Assign Azure Data Explorer Permissions

Your application must have read access to the ADX databases you want Dropzone to query.

You may use a Kusto management command to grant access. See here for more information.

{% hint style="info" %} Example management commands (run by an ADX admin):

.add cluster allDatabases viewers ('aadapp=<CLIENT_ID>;<TENANT_ID>')
.add database ['<DATABASE_NAME>'] viewers ('aadapp=<CLIENT_ID>;<TENANT_ID>')

{% endhint %}

Alternatively, you may use the Microsoft Azure portal to assign access to each database manually.

For each Azure Data Explorer cluster you want Dropzone to be able to access, do the following:

• As someone with Role-Based Action Control (e.g. as an Owner or User Access Administrator), navigate to your Azure portal
• Open your Azure Data Explorer cluster
• In the left hand side bar, navigate to Security + networking > Permissions

• Click "Add"
• Select the "AllDatabasesViewer" role

• In the "New Principles" section, add the application you just created

• Click "Select"

Repeat for each cluster you will use.

For each database within the Azure Data Explorer clusters you want Dropzone to access, do the following:

• In the Overview section of your cluster, under "Database," select the database you want Dropzone to access

• In the left hand side bar, click "Permissions"
• Click "Add"

• In the "New Principles" section, add the application you just created

• Click "Select"

Repeat for each database you will use.

Locate your ADX Cluster URL(s)

Dropzone can connect to one or more ADX clusters.

To collect a cluster URL, do the following:

• In the left sidebar of your Azure Data Explorer page, open the desired cluster

• In the Cluster details section, copy the Cluster URL for use later in the Dropzone UI where it is called "Cluster URL"

Repeat for each cluster you want Dropzone to query

Enable Azure Data Explorer

To enable the Data Source integration, you will need the following information:

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
• In the bottom right corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search Azure Data Explorer, then click "Configure"

• Input the Client ID, Tenant ID, and Client Secret

• Under Cluster Configuration, click "Add Item" and input at least one Cluster URL

• Input your desired timeout for queries (in minutes)

• Click "Test & Save" to finish

After saving, run the integration's test connection (or validation) to confirm credentials and permissions. If you use the Azure scanner, run the scanner for this integration so that workspaces and table schemas are discovered. The integration will then use those workspaces for Log Analytics queries.

If you have any errors, contact your Dropzone AI support representative.

Troubleshooting