Customer Integration

Creates an Azure Sentinel integration.

POST /partner-integration/{productID}/integration

Parameter	Mandatory/Optional	Data Type	Description
integrationType	Mandatory	String	Specify the type of integration. Provide the value as “azure_sentinel_v2”
tenantId	Mandatory	String	Azure Active Directory tenant ID.
clientId	Mandatory	String	Client ID of the Azure AD application.
clientSecret	Mandatory	String	Client secret associated with the Azure AD application.
endpointUrl	Mandatory	String	The endpoint URL for the Azure Sentinel API.
collectionRuleId	Mandatory	String	Identifier for the data collection rule in Azure Sentinel.
streamName	Mandatory	String	Name of the data stream to which logs or events are sent.
minSeverity	Optional	Integer	The minimum severity level of the vulnerabilities fetched from Qualys (VM/VMDR app) to be posted on the Azure Sentinel. By default, it is configured to severity level 3 and above. For example, if you set the value to 1, all findings with severity level 1 to 5 are fetched and available on Azure Sentinel.
baseCategory={IG\|Potential\| Confirmed}	Optional	String	Category of the vulnerabilities fetched from Qualys (VM/VMDR app) to be posted on the Azure Sentinel. The valid values are IG, Confirmed, and Potential. By default, it is configured to Confirmed. In this case, only confirmed vulnerabilities are included. If you configure the baseCategory as Potential, both Potential and Confirmed vulnerabilities are included.If you configure the baseCategory as IG, all three categories: IG, Potential and Confirmed vulnerabilities are included.
resultSectionNeeded	Optional	Boolean	Indicates whether the result section is required in the response (true/false).

SampleSample

API Request

"curl -X POST""<qualys_gateway_url>/partner-integration/{productID}/integration""-H""Authorization: Bearer <token>"

Request Body

{
    "integrationType": "azure_sentinel_v2",
    "tenantId": "<tenantId>",
    "clientId": "<clientId>",
    "clientSecret": "<clientSecret>",
    "endpointUrl": "<endpointUrl>",
    "collectionRuleId": "<collectionRuleId>",
    "streamName": "<streamName>",
    "minSeverity": 3,
    "baseCategory": "Confirmed",
    "resultSectionNeeded": true
}

Response

{
    "productName": "vm",
    "integrationType": "azure_sentinel_v2",
    "integrationValidated": true
}