Portal Activity in Sentinel, Next to Everything Else

What you can do together

• See who touched an evidence item, from which IP address and when, in the same Sentinel workbook as the Microsoft Entra ID sign-in that preceded it, from the chain-of-custody export of Nexus.
• Open a Sentinel incident on a media action or metadata change the moment it happens, on a webhook, rather than finding it in a report.
• Put a High-severity AI Live Insight detection into the SOC's queue, with the camera, the confidence and the time.
• Show an auditor that machine reads are on the record: an AI Intelligence Hub agent reading content appears in the trail you ingest, beside the human reads.

How it connects

Platform telemetry leaves over OTLP, the OpenTelemetry Protocol. An administrator sets one endpoint, the one that feeds your Sentinel workspace, and chooses OTLP over HTTP with protobuf or over gRPC. Traces, metrics and logs all use it, authenticated by API key, bearer token or basic credentials. A sampling ratio trims trace volume, and a service name and environment tag each portal so several stay distinguishable in one workspace. Sentinel is an exercised destination.

The audit record is a separate stream, and the one a compliance reviewer wants. Administrative actions go to a searchable audit log that exports for review outside the platform. The chain of custody records every action on an item with the user, email address, IP address, local date and time and the event, and exports as CSV or PDF, filtered by date, event, user, email or IP. Reads by an AI agent land in the same trail, attributed to the user who initiated them.

Webhooks carry events as they happen. The platform calls an endpoint you register on media actions, metadata changes, live session events and workflow completion, authenticated per webhook and subscribed per event or category. On AI Live Insight, each detection is sent as structured event data too. Every delivery is logged with its outcome and retries.