{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44906,"path":"security-management/security-incident-response/sentinel-integration-settings.md","title":"Review the Microsoft Azure Sentinel integration settings","bundle":null,"doc_type":null,"release":"australia","body":"\n# Review the Microsoft Azure Sentinel integration settings\n\nReview the Microsoft Azure Sentinel integration settings so that you can modify the system properties to suit your environment.\n\n## Before you begin\n\n**Important:**\n\nMicrosoft has extended the deprecation of the Azure Sentinel experience in the Azure portal from March 2026 to March 2027.\n\nIf you are currently using the Azure Sentinel integration with Security Incident Response \\(SIR\\), we strongly recommend migrating to the new Defender portal integration as soon as possible. The Defender integration includes a built-in migration utility that automatically converts your existing Sentinel profiles into Defender profiles, while ensuring continuity of incidents created through Sentinel after the transition. For more information, see [Microsoft Sentinel to Defender Migration Guide](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2795226).\n\nRole required: sn\\_si.ingestion\\_profile\\_admin\n\n**Note:** Users with the sn\\_si.admin role can perform all operations available to a profile admin, as the sn\\_si.admin role inherits the required permissions by default.\n\n## Procedure\n\n1. Navigate to **All** > **Microsoft Azure Sentinel Integration** > **Azure Sentinel Integration Settings**.\n\n2. Modify the following settings as required.\n\n\n
\n\nProperty Name\n\n\n\nDescription\n\n
\n\nEnforce a limit on the number of days for which sample data can be fetched.sn\\_sec\\_sentinel.max\\_num\\_of\\_days\\_for\\_sample\\_data\n\n\n\nMaximum number of days for which you can fetch sample data from the Microsoft Azure Sentinel environment.Type: integer\n\nDefault value: 7\n\n
\n\nReceive updates related to new alerts that are linked to SIR.sn\\_sec\\_sentinel.incident\\_updates\n\n\n\nActivate the option to receive incident updates.\n\nType: Boolean\n\nDefault value: True\n\n
\n\nThe delimiter character to split the values in Microsoft Azure Sentinel field mappings.sn\\_sec\\_sentinel.delimiter\n\n\n\nThe delimiter character to split the values in Microsoft Azure Sentinel field mappings.Type: String\n\nDefault value: ', ' \\(comma with space\\)\n\n
\n\nEnforce a limit on the number of sample incidents that can be fetched.sn\\_sec\\_sentinel.max\\_num\\_of\\_sample\\_incident\\_per\\_call\n\n\n\nMaximum number of sample incidents that you fetch from the Microsoft Azure Sentinel environment for ingestion.\n\nType: integerDefault value: 5\n\n Sample maximum value: 20\n\n
\n\nEnforce a limit on the number of sentinel incidents that can be aggregated to a single incident.sn\\_sec\\_sentinel.max\\_aggregations\\_per\\_si\n\n\n\nIncident aggregation limit for a security incident. For example, if there are 102 incidents, the first 100 are aggregated to security incident\\_1 and the remaining 2 to security incident\\_2.\n\nType: integerDefault value: 100\n\n
\n\nEnforce a limit on the number of security incidents that can be created in a 24-hour period.sn\\_sec\\_sentinel.max\\_si\\_per\\_day\n\n\n\nMaximum number of security incidents that can be created in a 24-hour period in the ServiceNow AI Platform.\n\nType: integerDefault value: 1000\n\n
\n\nMaximum pagination limit for fetching the incident data in one REST call.sn\\_sec\\_sentinel.max\\_page\\_size\n\n\n\nPagination limit for fetching the incident data in one REST call from the Microsoft Azure Sentinel environment.\n\nType: integerDefault value: 100\n\n
\n\nAPI version value for Incidents.sn\\_sec\\_sentinel.sentinel\\_security\\_incident\\_api\\_version\n\n\n\nThe Microsoft API version for retrieving Sentinel incidents.Default value: 2021-10-01\n\n
\n\nAPI version value for Alerts.sn\\_sec\\_sentinel.sentinel\\_security\\_alert\\_api\\_version\n\n\n\nThe Microsoft API version for retrieving Sentinel alerts.Default value: 2021-10-01\n\n
\n\nAPI version value for Entities.sn\\_sec\\_sentinel.sentinel\\_security\\_entities\\_api\\_version\n\n\n\nThe Microsoft API version for retrieving Sentinel entities.Default value: 2021-10-01\n\n
\n\nsn\\_sec\\_sentinel.logging.verbosity\n\n\n\nThe log verbosity level of the application, meaning the name of the type of information. You can also update the value to the following options:- **error**\n- **warn**\n- **info**\n- **debug**\n Default value: **info**.\n\n
3. Click **Save**.\n\n Your modified integration settings are applied in the next polling interval as defined in the profile.\n\n\n"}}