Sentinel CLI

The Sentinel CLI is a command-line interface for Microsoft Sentinel that supports secure authentication and deployment workflows. It enables automation of Sentinel resource management using scripts and CI/CD pipelines.

Installation

Install globally using npm:

npm install -g @microsoft/sentinel-cli

CLI Usage

Basic syntax:

sentinel [command] [options]

View available commands:

sentinel --help

Authentication Options

Authenticate using the login command with one of the supported methods:

1. Browser Authentication (Default)

sentinel login

Launches an interactive browser-based authentication using the authorization code flow. This is the default method when no authentication flag is provided.

2. Device Code

sentinel login --use-device-code

Authenticate interactively using the device code flow. Use this when you cannot open a browser directly on the machine running the CLI — you will be prompted to visit a URL and enter a code on any other browser-capable device.

3. Workload Identity

sentinel login --workload-identity

Authenticate using Workload Identity. Use this when running inside GitHub Actions, Azure DevOps Tasks, or other Azure-integrated environments that support workload identity federation.

4. Managed Identity (User-Assigned)

Authenticate using a user-assigned Managed Identity. Provide exactly one of the following identity selectors:

# Authenticate via Client ID
sentinel login --identity --client-id <client-id>

# Authenticate via Object ID
sentinel login --identity --object-id <object-id>

# Authenticate via Resource ID
sentinel login --identity --resource-id <resource-id>

Use this when running inside an Azure VM or other Azure resource with a user-assigned managed identity.

Parameters:

• --client-id <clientId>: User-assigned Managed Identity client ID
• --object-id <objectId>: User-assigned Managed Identity object ID
• --resource-id <resourceId>: User-assigned Managed Identity resource ID

Logout

Clear stored credentials and log out:

sentinel logout

Get Token

Get an access token for the current authentication:

# Get token using current authentication
sentinel token

# Get token using managed identity
sentinel token --client-id <client-id>

Resource Management Commands

Publish Job

Publish a Sentinel notebook using a deployment config:

sentinel job publish <notebookPath> --config <packagePath> --region <azureRegion>

Example:

sentinel job publish ./notebooks/example.ipynb --config ./configs/jobConfig.yaml --region eastus2euap

Parameters:

• <notebookPath>: Path to the Jupyter notebook file (.ipynb)
• --config, -c: Path to job configuration file (JSON or YAML)
• --region, -r: Target Azure region (default: Global)

Create Zip

Create a deployment package from a manifest file:

sentinel package create-zip <manifestPath>

Example:

sentinel package create-zip ./manifest.json

Parameters:

• <manifestPath>: Path to the manifest file that describes the package contents

Validate

Validate a YAML configuration file against the schema:

sentinel validate --file <yamlPath>

Example:

sentinel validate --file ./configs/jobConfig.yaml

Parameters:

• --file, -f: Path to the YAML file to validate

Permissions

Grant the appropriate Azure RBAC permissions following the Sentinel onboarding.

Contributing

The project is released under the MIT License.

Data and Telemetry

The Microsoft Sentinel CLI does not collect usage data. Read our privacy statement to learn more.

Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the FAQ or contact [email protected].