Overview

The Dropzone platform integrates with Azure Data Explorer (Kusto) so analysts can investigate organization-specific logs and telemetry that may not exist in Sentinel or Defender.

Dropzone uses your Microsoft Entra service principal to authenticate to one or more ADX clusters, discover available databases and tables, and execute read-only KQL queries. The ADX scanner builds table metadata (descriptions, fields, and query guidance) so the assistant can choose relevant tables and generate better queries.

Integration Overview

To enable these integrations you will perform the following actions:

• Register a new application in Microsoft Entra Admin Center
• Locate your Client ID, Tenant ID, and create a Client Secret
• Assign Azure Data Explorer permissions for your service principal
• Collect your ADX Cluster URL(s)
• Install the credentials into your Dropzone tenant
• Run the scanner to discover ADX tables and schemas

See the Microsoft Integrations page for instructions on how to register a new application, locate your Client ID and Tenant ID, and create a Client Secret.

When registering the application, set the "Supported account types" to "Accounts in this organizational directory only" and leave "Redirect URI" blank. No Microsoft Graph API permissions are required for this integration.

Assign Azure Data Explorer Permissions

Your application must have read access to the ADX databases you want Dropzone to query.

You may use a Kusto management command to grant access. See here for more information.

Example management commands (run by an ADX admin):

.add cluster allDatabases viewers ('aadapp=<CLIENT_ID>;<TENANT_ID>')
.add database ['<DATABASE_NAME>'] viewers ('aadapp=<CLIENT_ID>;<TENANT_ID>')

Alternatively, you may use the Microsoft Azure portal to assign access to each database manually.

For each Azure Data Explorer cluster you want Dropzone to be able to access, do the following:

• As someone with Role-Based Action Control (e.g. as an Owner or User Access Administrator), navigate to your Azure portal
• Open your Azure Data Explorer cluster
• In the left hand side bar, navigate to Security + networking > Permissions

Click "Permissions" and then "Add". Select the "AllDatabasesViewer" role and in the "New Principles" section, add the application you just created. Assign the role to your application and click "Select". Repeat for each cluster you will use.

For each database within the Azure Data Explorer clusters you want Dropzone to access, do the following:

• In the Overview section of your cluster, under "Database," select the database you want Dropzone to access
• In the left hand side bar, click "Permissions"
• Click "Add"
• In the "New Principles" section, add the application you just created
• Click "Select". Repeat for each database you will use.

Locate your ADX Cluster URL(s)

Dropzone can connect to one or more ADX clusters.

To collect a cluster URL, do the following:

• In the left sidebar of your Azure Data Explorer page, open the desired cluster.
• In the Cluster details section, copy the Cluster URL for use later in the Dropzone UI where it is called "Cluster URL". Repeat for each cluster you want Dropzone to query.

Enable Azure Data Explorer

To enable the Data Source integration, you will need the following information:

• Tenant ID: The Directory ID copied earlier
• Client ID: The Application ID copied earlier
• Client Secret: The Client Secret Value copied earlier
• Cluster URL: The Cluster URLs copied earlier

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
• In the bottom right corner, navigate to Settings > Integrations
• Click "Available"
• In the Search bar, search Azure Data Explorer, then click "Configure"
• Input the Client ID, Tenant ID, and Client Secret.
• Under Cluster Configuration, click "Add Item" and input at least one Cluster URL.
• Input your desired timeout for queries (in minutes).
• Click "Test & Save" to finish. After saving, run the integration's test connection (or validation) to confirm credentials and permissions. If you use the Azure scanner, run the scanner for this integration so that workspaces and table schemas are discovered.

If you have any errors, contact your Dropzone AI support representative.

Troubleshooting

Symptom

• "Credentials are incomplete" or auth errors: Verify Tenant ID, Client ID, and Client Secret; ensure the secret has not expired.
• "Failed to list resource groups": Ensure Reader is assigned on that subscription; role assignment can take a few minutes to propagate.
• "Failed to query Azure Log Analytics" or 403 on workspace query: Ensure Log Analytics Reader is assigned on that specific workspace; confirm the workspace ID in config matches the workspace.
• Activity log query fails: Ensure Reader is assigned on the subscription (subscription-level Activity Log is covered by Reader).