> Source: [sk182975](https://support.checkpoint.com/results/sk/sk182975)

# sk182975 - How to set up Azure Sentinel Alerts on ERM

| Property | Value |
|----------|-------|
| Solution ID | sk182975 |
| Date Created | 2025-02-05 |
| Last Modified | 2025-03-02 |
| Technical Level | General |
| Products | External Risk Management |
| Versions | Cloud |

## Solution

This article guides you through the steps for integrating your Azure account with ERM platform and how to troubleshoot various issues that may arise during integration.  
Before starting the steps, make sure you have these requirements:   

* Ensure you have an active Azure account with sufficient permissions to create resources.
* After login in, use your ERM account (to get the API Token check article sk183013)

NOTE: Token should be generated from the user itself (or from dedicated user).  

**Procedure to configure the integration:**   

1. Log in to your **Azure account**
2. Create a new **Logic App**
3. Ensure that **Managed Identity** for the Logic App is enabled
4. Switch to **Code View** and paste in the JSON code
5. Use**JSON Lint** to verify and validate the json format
6. Save the Logic App **code**
7. Configure the Logic App to **execute regularly**
8. Grant Azure Sentinel **Contributor Role** to Logic App at the Resource Group Level

<br />

**Create a Blank logic app**

1. Sign In to **Azure Portal**
   * Go to: Azure Portal https://portal.azure.com/
   * Log in with your Azure credentials.
2. Create a new **Logic App**
   * Navigate to: **All services \> Logic Apps**
   * Click: + **Add** or + **Create**
   * Configure Basics:
     * Subscription: Select your Azure subscription.
     * Resource Group: Choose or create a new one.
     * Logic App name: Enter a unique name.
     * Region: Choose your preferred region.
     * Select Type: Choose Logic App (Consumption) for pay-as-you-go pricing.
3. Click: Review + Create, then Create.
4. Ensure that the Logic app's Managed Identity is enabled
   * Under the Settings section in the navigation bar, select Identity

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1735667047682/bc828caa-21da-481e-acc3-5fcf4da17c37202412311023312.png)  

Switch the **Status** slider to **On** and verify that you wish to perform this action.  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/3d8423d6-6647-4ad6-ad02-c55adf9e25e5202412311118351.png)  

You will assign role assignments later.  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/5271d778-71f1-43cc-9590-ed3179160114202412311120102.png)![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/5271d778-71f1-43cc-9590-ed3179160114202412311120333.png)  

5. Switch to **Code View** to paste in JSON code  

* After activating the managed Identity, proceed to the Code View within Logic app.
* Under the "Development Tools" section in the navigation bar, select "Logic app code view"

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/7d7a7240-c5fb-43a8-bafe-297cdda0f098202412311125234.png)  

Insert this code, making sure to substitute the elements marked in yellow with the relevant information specific to your environment.  

The information you will need to gather is:  

* Microsoft Sentinel Subscription ID
* Microsoft Sentinel Resource Group Name
* Microsoft Sentinel Deployment Region
* ERM API Token
* ERM Environment URL

**Use the following code to implement the foundational logic structure. Substitute next placeholders in the JSON with an appropriate value:**   

* \<Microsoft Sentinel subscription id\>
* \<Microsoft Sentinel resource group name\>
* \<Microsoft Sentinel workspace name\>
* \<Azure region

Click here to see the code   
`{`  
` "definition":`  
` {`  
` "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",`  
` "actions":`  
` {`  
` "For_each_Result":`  
` {`  
` "actions":`  
` {`  
` "Set_alertBody":`  
` {`  
` "inputs":`  
` {`  
` "name": "alertBody",`  
` "value": "@items('For_each_Result')"`  
` },`  
` "runAfter":`  
` {`  
` "Set_resultType":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "SetVariable"`  
` },`  
` "Set_resultType":`  
` {`  
` "inputs":`  
` {`  
` "name": "resultType",`  
` "value": "@{items('For_each_Result').type}"`  
` },`  
` "type": "SetVariable"`  
` },`  
` "Switch_Alert_Type":`  
` {`  
` "cases":`  
` {`  
` "compromised_customer_credentials":`  
` {`  
` "actions":`  
` {`  
` "For_each_CSV_row":`  
` {`  
` "actions":`  
` {`  
` "Create_incident_CCC":`  
` {`  
` "inputs":`  
` {`  
` "body":`  
` {`  
` "description": "Username: @{outputs('Parse_Compromised_Credentials').username}\\nPassword: @{outputs('Parse_Compromised_Credentials').password}\\n\\nCompany Customer Credentials Exposed\\n\\nCategory: @{items('For_each_Result').category}\\n\\nDescription: @{items('For_each_Result').description}\\n\\nRecommendation: @{items('For_each_Result').recommendation}\\n\\nEntities: @{items('For_each_Result').related_entities}\\n\\nAsset: @{items('For_each_Result').related_assets}\\n\\nImpacts: @{items('For_each_Result').impacts}\\n\\nMITRE: @{items('For_each_Result').mitre}",`  
` "owner": "@{items('For_each_Result').ref_id}",`  
` "severity": "@{if(equals(items('For_each_Result').severity,'very_high'), 'High', concat(toUpper(take(items('For_each_Result').severity, 1)), toLower(skip(items('For_each_Result').severity, 1))))}",`  
` "status": "New",`  
` "tagsToAdd":`  
` {`  
` "TagsToAdd":`  
` [`  
` {`  
` "Tag": "Cyberint"`  
` }`  
` ]`  
` },`  
` "title": "@{items('For_each_Result').title}"`  
` },`  
` "host":`  
` {`  
` "connection":`  
` {`  
` "name": "@parameters('$connections')['<API connection name>']['connectionId']"`  
` }`  
` },`  
` "method": "put",`  
` "path": "/Incidents/subscriptions/@{encodeURIComponent('<Microsoft Sentinel subscription id>')}/resourceGroups/@{encodeURIComponent('<Microsoft Sentinel resource group name>')}/workspaces/@{encodeURIComponent('<Microsoft Sentinel workspace name>')}"`  
` },`  
` "runAfter":`  
` {`  
` "Parse_Compromised_Credentials":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "ApiConnection"`  
` },`  
` "Parse_Compromised_Credentials":`  
` {`  
` "inputs":`  
` {`  
` "password": "@items('For_each_CSV_row').password",`  
` "username": "@items('For_each_CSV_row').username"`  
` },`  
` "type": "Compose"`  
` }`  
` },`  
` "foreach": "@items('For_each_Result')?['alert_data']?['csv']?['content']",`  
` "type": "Foreach"`  
` }`  
` },`  
` "case": "compromised_customer_credentials"`  
` },`  
` "phishing_website":`  
` {`  
` "actions":`  
` {`  
` "Create_incident_PW":`  
` {`  
` "inputs":`  
` {`  
` "body":`  
` {`  
` "description": "URL: @{outputs('Parse_Phishing_Website').url}\\nTitle: @{outputs('Parse_Phishing_Website')?.title}\\n\\nPhishing Website\\n\\nCategory: @{items('For_each_Result').category}\\n\\nDescription: @{items('For_each_Result').description}\\n\\nRecommendation: @{items('For_each_Result').recommendation}\\n\\nEntities: @{items('For_each_Result').related_entities}\\n\\nAsset: @{items('For_each_Result').related_assets}\\n\\nImpacts: @{items('For_each_Result').impacts}\\n\\nMITRE: @{items('For_each_Result').mitre}",`  
` "owner": "@{items('For_each_Result').ref_id}",`  
` "severity": "@{if(equals(items('For_each_Result').severity,'very_high'), 'High', concat(toUpper(take(items('For_each_Result').severity, 1)), toLower(skip(items('For_each_Result').severity, 1))))}",`  
` "status": "New",`  
` "tagsToAdd":`  
` {`  
` "TagsToAdd":`  
` [`  
` {`  
` "Tag": "Cyberint"`  
` }`  
` ]`  
` },`  
` "title": "@{items('For_each_Result').title}"`  
` },`  
` "host":`  
` {`  
` "connection":`  
` {`  
` "name": "@parameters('$connections')['<API connection name>']['connectionId']"`  
` }`  
` },`  
` "method": "put",`  
` "path": "/Incidents/subscriptions/@{encodeURIComponent('<Microsoft Sentinel subscription id>')}/resourceGroups/@{encodeURIComponent('<Microsoft Sentinel resource group name>')}/workspaces/@{encodeURIComponent('<Microsoft Sentinel workspace name>')}"`  
` },`  
` "runAfter":`  
` {`  
` "Parse_Phishing_Website":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "ApiConnection"`  
` },`  
` "Parse_Phishing_Website":`  
` {`  
` "inputs":`  
` {`  
` "title": "@items('For_each_Result')?['alert_data']?['title']",`  
` "url": "@items('For_each_Result')?['alert_data']?['url']"`  
` },`  
` "type": "Compose"`  
` }`  
` },`  
` "case": "phishing_website"`  
` },`  
` "vulnerabilities":`  
` {`  
` "actions":`  
` {`  
` "For_each_CVE":`  
` {`  
` "actions":`  
` {`  
` "Create_incident_VUL":`  
` {`  
` "inputs":`  
` {`  
` "body":`  
` {`  
` "description": "Vulnerability: @{outputs('Parse_Vulnerabilities').vulnerability}\\n\\nCategory: @{items('For_each_Result').category}\\n\\nDescription: @{items('For_each_Result').description}\\n\\nRecommendation: @{items('For_each_Result').recommendation}\\n\\nEntities: @{items('For_each_Result').related_entities}\\n\\nAsset: @{items('For_each_Result').related_assets}\\n\\nImpacts: @{items('For_each_Result').impacts}\\n\\nMITRE: @{items('For_each_Result').mitre}",`  
` "owner": "@items('For_each_Result').ref_id",`  
` "severity": "@{if(equals(items('For_each_Result').severity,'very_high'), 'High', concat(toUpper(take(items('For_each_Result').severity, 1)), toLower(skip(items('For_each_Result').severity, 1))))}",`  
` "status": "New",`  
` "tagsToAdd":`  
` {`  
` "TagsToAdd":`  
` [`  
` {`  
` "Tag": "Cyberint"`  
` }`  
` ]`  
` },`  
` "title": "@{items('For_each_Result').title}"`  
` },`  
` "host":`  
` {`  
` "connection":`  
` {`  
` "name": "@parameters('$connections')['<API connection name>']['connectionId']"`  
` }`  
` },`  
` "method": "put",`  
` "path": "/Incidents/subscriptions/@{encodeURIComponent('<Microsoft Sentinel subscription id>')}/resourceGroups/@{encodeURIComponent('<Microsoft Sentinel resource group name>')}/workspaces/@{encodeURIComponent('<Microsoft Sentinel workspace name>')}"`  
` },`  
` "runAfter":`  
` {`  
` "Parse_Vulnerabilities":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "ApiConnection"`  
` },`  
` "Parse_Vulnerabilities":`  
` {`  
` "inputs":`  
` {`  
` "vulnerability": "@items('For_each_CVE').name"`  
` },`  
` "type": "Compose"`  
` }`  
` },`  
` "foreach": "@items('For_each_Result')?['alert_data']?['cves']",`  
` "type": "Foreach"`  
` }`  
` },`  
` "case": "vulnerabilities"`  
` }`  
` },`  
` "default":`  
` {`  
` "actions":`  
` {`  
` "Create_incident_default":`  
` {`  
` "inputs":`  
` {`  
` "body":`  
` {`  
` "description": "Category: @{items('For_each_Result').category}\\n\\nDescription: @{items('For_each_Result').description}\\n\\nRecommendation: @{items('For_each_Result').recommendation}\\n\\nEntities: @{items('For_each_Result').related_entities}\\n\\nAsset: @{items('For_each_Result').related_assets}\\n\\nImpacts: @{items('For_each_Result').impacts}\\n\\nMITRE: @{items('For_each_Result').mitre}\\n\\nAlert data: @{items('For_each_Result').alert_data}",`  
` "owner": "@{items('For_each_Result').ref_id}",`  
` "severity": "@{if(equals(items('For_each_Result').severity,'very_high'), 'High', concat(toUpper(take(items('For_each_Result').severity, 1)), toLower(skip(items('For_each_Result').severity, 1))))}",`  
` "status": "New",`  
` "tagsToAdd":`  
` {`  
` "TagsToAdd":`  
` [`  
` {`  
` "Tag": "Cyberint"`  
` }`  
` ]`  
` },`  
` "title": "@{items('For_each_Result').title}"`  
` },`  
` "host":`  
` {`  
` "connection":`  
` {`  
` "name": "@parameters('$connections')['<API connection name>']['connectionId']"`  
` }`  
` },`  
` "method": "put",`  
` "path": "/Incidents/subscriptions/@{encodeURIComponent('<Microsoft Sentinel subscription id>')}/resourceGroups/@{encodeURIComponent('<Microsoft Sentinel resource group name>')}/workspaces/@{encodeURIComponent('<Microsoft Sentinel workspace name>')}"`  
` },`  
` "type": "ApiConnection"`  
` }`  
` }`  
` },`  
` "expression": "@variables('resultType')",`  
` "runAfter":`  
` {`  
` "Set_alertBody":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "Switch"`  
` }`  
` },`  
` "foreach": "@body('Parse_JSON_-_Output_API_Call')?['alerts']",`  
` "runAfter":`  
` {`  
` "Parse_JSON_-_Output_API_Call":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "Foreach"`  
` },`  
` "HTTP_-_Get_Cyberint_Alerts":`  
` {`  
` "inputs":`  
` {`  
` "body":`  
` {`  
` "filters":`  
` {`  
` "created_date":`  
` {`  
` "from": "@{triggerOutputs()['windowStartTime']}",`  
` "to": "@{triggerOutputs()['windowEndTime']}"`  
` },`  
` "status":`  
` [`  
` "open"`  
` ]`  
` },`  
` "include_csv_attachments_as_json_content": true,`  
` "page": 1,`  
` "size": 10`  
` },`  
` "cookie": "access_token=4iU3AhNnEin909PhK9n118TIme6M54BCioel1NK5_QXYGITtlG5E3DfzBHkL0uwfSAGXUnXd8B8_cZstBkUd3KEXJ3S8VK20uma6A-yhrV56OHE_MqOueXR9EbD53LC9x80TN6gaCDClWBJUKETtEm5DD-pU3nMJzw7DNOEQ123",`  
` "method": "POST",`  
` "uri": "https://yourtenant.cyberint.io/alert/api/v1/alerts"`  
` },`  
` "runAfter":`  
` {`  
` "Initialize_alertBody":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "Http"`  
` },`  
` "Initialize_alertBody":`  
` {`  
` "inputs":`  
` {`  
` "variables":`  
` [`  
` {`  
` "name": "alertBody",`  
` "type": "object"`  
` }`  
` ]`  
` },`  
` "runAfter":`  
` {`  
` "Initialize_resultType":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "InitializeVariable"`  
` },`  
` "Initialize_resultType":`  
` {`  
` "inputs":`  
` {`  
` "variables":`  
` [`  
` {`  
` "name": "resultType",`  
` "type": "string",`  
` "value": ""`  
` }`  
` ]`  
` },`  
` "runAfter":`  
` {},`  
` "type": "InitializeVariable"`  
` },`  
` "Parse_JSON_-_Output_API_Call":`  
` {`  
` "inputs":`  
` {`  
` "content": "@body('HTTP_-_Get_Cyberint_Alerts')",`  
` "schema":`  
` {`  
` "properties":`  
` {`  
` "alerts":`  
` {`  
` "items":`  
` {`  
` "properties":`  
` {`  
` "acknowledged_by":`  
` {},`  
` "acknowledged_date":`  
` {},`  
` "alert_data":`  
` {`  
` "properties":`  
` {`  
` "application":`  
` {},`  
` "csv":`  
` {`  
` "properties":`  
` {`  
` "content":`  
` {},`  
` "hashed_attachment_content_csv":`  
` {`  
` "properties":`  
` {`  
` "password":`  
` {`  
` "type": "string"`  
` },`  
` "username":`  
` {`  
` "type": "string"`  
` }`  
` },`  
` "type": "object"`  
` },`  
` "total_credentials":`  
` {`  
` "type": "integer"`  
` }`  
` },`  
` "type": "object"`  
` },`  
` "hashed_attachment_content_csv":`  
` {`  
` "type": "string"`  
` },`  
` "total_credentials":`  
` {`  
` "type": "integer"`  
` }`  
` },`  
` "type": "object"`  
` },`  
` "analysis_report":`  
` {},`  
` "attachments":`  
` {`  
` "type": "array"`  
` },`  
` "category":`  
` {`  
` "type": "string"`  
` },`  
` "closed_by":`  
` {},`  
` "closure_date":`  
` {},`  
` "closure_reason":`  
` {},`  
` "closure_reason_description":`  
` {},`  
` "confidence":`  
` {`  
` "type": "integer"`  
` },`  
` "created_by":`  
` {`  
` "properties":`  
` {`  
` "email":`  
` {`  
` "type": "string"`  
` }`  
` },`  
` "type": "object"`  
` },`  
` "created_date":`  
` {`  
` "type": "string"`  
` },`  
` "description":`  
` {`  
` "type": "string"`  
` },`  
` "environment":`  
` {`  
` "type": "string"`  
` },`  
` "impacts":`  
` {`  
` "items":`  
` {`  
` "type": "string"`  
` },`  
` "type": "array"`  
` },`  
` "iocs":`  
` {`  
` "type": "array"`  
` },`  
` "mitre":`  
` {`  
` "items":`  
` {`  
` "type": "string"`  
` },`  
` "type": "array"`  
` },`  
` "modification_date":`  
` {`  
` "type": "string"`  
` },`  
` "publish_date":`  
` {`  
` "type":`  
` [`  
` "string",`  
` "null"`  
` ]`  
` },`  
` "recommendation":`  
` {`  
` "type": "string"`  
` },`  
` "ref_id":`  
` {`  
` "type": "string"`  
` },`  
` "related_assets":`  
` {`  
` "type": "array"`  
` },`  
` "related_entities":`  
` {`  
` "items":`  
` {`  
` "type": "string"`  
` },`  
` "type": "array"`  
` },`  
` "severity":`  
` {`  
` "type": "string"`  
` },`  
` "source":`  
` {`  
` "type":`  
` [`  
` "string",`  
` "null"`  
` ]`  
` },`  
` "source_category":`  
` {`  
` "type":`  
` [`  
` "string",`  
` "null"`  
` ]`  
` },`  
` "status":`  
` {`  
` "type": "string"`  
` },`  
` "tags":`  
` {`  
` "type": "array"`  
` },`  
` "targeted_brands":`  
` {`  
` "items":`  
` {`  
` "type": "string"`  
` },`  
` "type": "array"`  
` },`  
` "targeted_vectors":`  
` {`  
` "items":`  
` {`  
` "type": "string"`  
` },`  
` "type": "array"`  
` },`  
` "threat_actor":`  
` {},`  
` "ticket_id":`  
` {},`  
` "title":`  
` {`  
` "type": "string"`  
` },`  
` "type":`  
` {`  
` "type": "string"`  
` }`  
` },`  
` "required":`  
` [`  
` "environment",`  
` "ref_id",`  
` "confidence",`  
` "status",`  
` "severity",`  
` "created_date",`  
` "created_by",`  
` "category",`  
` "type",`  
` "source_category",`  
` "source",`  
` "targeted_vectors",`  
` "targeted_brands",`  
` "related_entities",`  
` "impacts",`  
` "acknowledged_date",`  
` "acknowledged_by",`  
` "publish_date",`  
` "title",`  
` "alert_data",`  
` "iocs",`  
` "ticket_id",`  
` "threat_actor",`  
` "modification_date",`  
` "closure_date",`  
` "closed_by",`  
` "closure_reason",`  
` "closure_reason_description",`  
` "description",`  
` "recommendation",`  
` "tags",`  
` "analysis_report",`  
` "attachments",`  
` "mitre",`  
` "related_assets"`  
` ],`  
` "type": "object"`  
` },`  
` "type": "array"`  
` },`  
` "total":`  
` {`  
` "type": "integer"`  
` }`  
` },`  
` "type": "object"`  
` }`  
` },`  
` "runAfter":`  
` {`  
` "HTTP_-_Get_Cyberint_Alerts":`  
` [`  
` "Succeeded"`  
` ]`  
` },`  
` "type": "ParseJson"`  
` }`  
` },`  
` "contentVersion": "1.0.0.0",`  
` "outputs":`  
` {},`  
` "parameters":`  
` {`  
` "$connections":`  
` {`  
` "defaultValue":`  
` {},`  
` "type": "Object"`  
` }`  
` },`  
` "triggers":`  
` {`  
` "Sliding_Window":`  
` {`  
` "evaluatedRecurrence":`  
` {`  
` "frequency": "Minute",`  
` "interval": 3`  
` },`  
` "recurrence":`  
` {`  
` "frequency": "Minute",`  
` "interval": 3`  
` },`  
` "type": "SlidingWindow"`  
` }`  
` }`  
` },`  
` "parameters":`  
` {`  
` "$connections":`  
` {`  
` "value":`  
` {`  
` "<API connection name>":`  
` {`  
` "connectionId": "/subscriptions/<Microsoft Sentinel subscription id>/resourceGroups/<Microsoft Sentinel resource group name>/providers/Microsoft.Web/connections/<API connection name>",`  
` "connectionName": "<API connection name>",`  
` "id": "/subscriptions/<Microsoft Sentinel subscription id>/providers/Microsoft.Web/locations/<Azure region>/managedApis/<API connection name>"`  
` }`  
` }`  
` }`  
` }`  
`}`

6. Utilize **JSON Lint** Validator  

Since you have modified the JSON code, it makes sense to double check it.  
In a new tab or window in your browser, go to JSON Online Validator and Formatter: https://jsonlint.com/  
Paste in your modified code, and then click on the green Validate JSON button.   
Fix any errors that may show up and repeat the process until the JSON passes. Copy the modified code if you made any changes back into the Logic App.

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/7411713f-e727-4d69-9446-0d130f3bba79202412311144345.png)  

7. Save the Logic App code

*
  * In the Logic App code view page, click on the Save button. The Azure portal notifications bell will show that this activity is running. You can click on that to see if any errors have occurred.

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/3cd62150-3a6b-45e2-974b-f6ed3fd2e7ee202412311147206.png)  

8. Adjust the recurrence of the Logic App  

*
  * This Logic App should run regularly because ERM produces Alerts every day. Optionally, a specific time of day can be selected for the Logic App to execute.

<!-- -->

* Select the Sliding Window trigger at the beginning of the Logic App.
* Change the Interval and the Frequency to desirable.

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/image-20240815-083559202412311152561.png)  
9. Grant Microsoft Sentinel Contributor Role to Logic app at the Resource Group Level  

To resolve the **Unauthorized issue** at the last step for Logic app, the Logic App's managed identity will need Microsoft Sentinel contributor rights. Use the following steps to grant this right:  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/image-20240815-084009202412311155402.png)  

* Login to Azure portal: Microsoft Azure
* Go to the Azure Sentinel's Resource Group
* Navigate to Access Control (IAM)

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/VipulDabhi_26-1722962095453202412311156453.png)  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/VipulDabhi_27-1722962095456202412311157264.png)  

<br />

* Click on the Add button and select Add role assignment
* Select Microsoft Sentinel Contributor role and then click the "Next" button at the bottom of the screen

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/VipulDabhi_28-1722962095475 (1)202412311158215.png)  

* Select the Managed identity radio button

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/VipulDabhi_29-1722962095477202412311159466.png)  

* Click Select members
* Select the correct Subscription
* In the Managed Identity drop down, select Logic app

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/VipulDabhi_30-1722962095478202412311201487.png)  

* Finde the name of the Logic App and select it
* Client the Select button at the bottom of the page
* Click the Review and assign button at the bottom of the page to assign the permission

<br />

The Logic App is now ready to be run to ingest the ERM Alerts.  

The verify that the data is being ingested, you can use the Sentinel page to validate.  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182975/image-20240815-084203202412311203028.png)  

<br />

If any issue arise during configuration, please reach out to our support team.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content