Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do You Send an AI Agent's Activity Record to Microsoft Sentinel or CrowdStrike Falcon?

Post a per-run record of screens as tokens, actions and approvers to Sentinel through the Logs Ingestion API or to Falcon through an HTTP Event Collector, then add a parser and a rule on denied actions. The record carries ACCT_001 rather than real values because values were replaced before the model read the screen, and the task completed.

Activity from several screens becomes a compact event stream feeding separate chart and log destinations.

Post a per-run record of screens as tokens, actions and approvers to Sentinel through the Logs Ingestion API or to Falcon through an HTTP Event Collector, then add a parser and a rule on denied actions. The record carries ACCT_001 rather than real values because values were replaced before the model read the screen, and the task completed. Security teams already route application, identity and endpoint telemetry into one of these two platforms, and the question for an agent program is how its record joins them without becoming a second copy of the data the agent handled. The answer depends on what the record contains, which is narrower than it sounds: it is metadata about what the model received and did, not a recording of everything the model observed. This page states what a per-run record holds and leaves out, gives the ingestion steps for Sentinel and for Falcon from each vendor's documentation, sets out the detections worth writing, summarizes what the vendors document and do not, and describes what changes when the record comes from an environment that tokenized the screen. It builds on research on how to know which pages and records an AI agent accessed and research on auditing what an AI agent saw and did.

Key findings

  • The Azure Monitor Logs Ingestion API "lets you send data to a Log Analytics workspace using either a REST API call or client libraries"; the call names a data collection rule that "includes the target table and workspace," and custom tables need the _CL suffix (Microsoft, 2026).
  • In Microsoft Sentinel, data collection rules "allow you to both collect and manipulate your data before it's stored in your workspace," with KQL transformations that can filter, enrich or mask incoming data (Microsoft, 2026).
  • CrowdStrike's HEC connector "enables ingestion of data from any source using the HTTP or HTTPS protocol," and the API key "displays only once during setup" (CrowdStrike, 2026).
  • The CrowdStrike Parsing Standard "builds on the Elastic Common Schema (ECS)," and for sources without a built-in connector "you must provide parsers and mappings" (CrowdStrike, 2026).
  • Chan et al. propose three visibility measures for AI agents: "agent identifiers, real-time monitoring, and activity logging," which is the function a SIEM export serves (arXiv, 2024).
  • Microsoft's Purview audit log for Copilot records "references to all resources (files, documents, emails, etc.) which Copilot accessed," a reference list rather than the content, the same shape as the record described here (Microsoft, 2026).

What does an AI agent's activity record contain, and what does it leave out?

A per-run record is a sequence of events for one agent working one task. Each event belongs to one of three types. A screen event records the page the model received, with each sensitive field shown as the token the model saw: ACCT_001 for an account number, CUST_001 for a name. An action event records what the agent did on that page, the field it filled, the button it pressed, and whether the action was allowed or denied. An approval event records the named person who confirmed a consequential action, such as a payment release or a record change, and when. Each event carries the run identifier, the agent identity, the user on whose behalf it acted, and a timestamp.

What the record leaves out matters as much to a security team as what it holds. The export is metadata, not a recording of everything the model observed. It does not contain the real values that the tokens replaced, because the model never received them. It does not contain screenshots or the full text of each page; it contains the field-level token view the model worked from and the actions taken against it. It is not a transcript of the model's reasoning. Microsoft's own Copilot audit log takes the same shape: its AccessedResources property lists "references to all resources (files, documents, emails, etc.) which Copilot accessed in response to the user's request," references rather than content (Microsoft, 2026).

That shape is what makes the record safe to send. A SIEM that receives a copy of every customer value an agent read becomes a new store of regulated data with its own retention and access questions. A SIEM that receives tokens, actions and approvers receives evidence. Chan et al. list activity logging alongside agent identifiers and real-time monitoring as the three measures that give an organization visibility into agents (arXiv, 2024); the record described here supplies the first and third, and the SIEM analytics rule supplies the second.

How do you land the record in Microsoft Sentinel?

Sentinel sits on a Log Analytics workspace, and the documented path for custom-format data is the Azure Monitor Logs Ingestion API. Microsoft states that it "lets you send data to a Log Analytics workspace using either a REST API call or client libraries." The call is a POST to a DCR stream endpoint; the request "specifies a data collection rule (DCR) that includes the target table and workspace," authenticates with a bearer token from an app registration holding Monitoring Metrics Publisher on the DCR, and carries a JSON array matching the DCR's stream declaration (Microsoft, 2026).

Four steps follow. Create a custom table, which Microsoft requires to end in _CL, for example AgentControlRecord_CL, with columns for run identifier, agent identity, user, event type, page, field, token, action, outcome, approver and timestamp; column names are limited to 45 alphanumeric characters and underscores. Create a DCR matching those columns with the table as destination. Register an application, grant it the role, and give the exporting environment its credentials. Post each run's events as a JSON array over TLS 1.2 or higher, which Microsoft enforces from March 1, 2026 (Microsoft, 2026).

The DCR is also where the record can be shaped. Sentinel's documentation states that transformations "apply KQL queries to incoming data before it's stored," and can filter, enrich or mask (Microsoft, 2026). For a token-only record there is nothing to mask, but a transformation can enrich each event with the agent's owning team. Microsoft cautions that Basic tables incur a filtering charge when a transformation drops more than half the incoming data, so the choice of which events to send belongs upstream.

How do you land the record in CrowdStrike Falcon Next-Gen SIEM?

Falcon Next-Gen SIEM takes third-party data through data connectors, and for a source without a built-in connector the documented path is the HEC, or HTTP Event Collector. CrowdStrike states that it "enables ingestion of data from any source using the HTTP or HTTPS protocol." The administrator creates an HEC data connector in the Falcon console; "the API key and URL are displayed on the connector's detail page after creation," and the shipper, with the Falcon LogScale Collector recommended, posts "structured or raw event data" to that URL with the key (CrowdStrike, 2026).

Two requirements are worth planning for. CrowdStrike tells administrators to "record your API key immediately" because "it displays only once during setup," so the one-time display is itself a moment to handle with care. The connector requires a Next-Gen SIEM subscription, one of the US-1, US-2, EU-1 or US-GOV-1 clouds, and the Administrator or Connector Manager role (CrowdStrike, 2026).

The data then needs a parser. The CrowdStrike Parsing Standard "builds on the Elastic Common Schema (ECS)" so that teams can "easily ingest, parse, and normalize all third-party data"; vendor field names map to unified ECS-based names, and CrowdStrike states that "extracting fields and tags during the parsing stage is essential for search performance." For a source without a built-in connector, "you must provide parsers and mappings" (CrowdStrike, 2026). For the agent record, that means mapping run identifier, agent identity, user, action and outcome to their ECS counterparts and keeping token, page, field and approver as vendor-specific fields. Once parsed, the record sits next to endpoint and identity telemetry and joins to them by user and time.

Which detections should run on the record once it lands?

Three detections cover most of what a security team wants to know. A denied action: the agent attempted something the policy did not allow, such as a field write outside its task. An approval: a named person confirmed a consequential action, which is evidence, while a consequential action with no approval event is the alert. Drift: record types the agent had not read before.

Take a Sentinel analytics rule as the worked screen. Without the record, the rule has only the application's audit log, which shows a user account updating a wire exception record, cannot distinguish the agent from the person whose account it used, and shows the analyst the customer's account number. With the record, the rule queries AgentControlRecord_CL where Outcome is "denied," joined to the run's approval events. The analyst sees the agent identity, the page as the model received it with ACCT_001 in the account field, the denied write, and whether an approver is present. The wire exception was resolved and the record change confirmed by a named person; the analyst saw the evidence and no customer value.

ESMA describes DORA as bringing "harmonisation of the rules relating to digital operational resilience for the financial sector," applying from January 17, 2025, with incident management and reporting in Articles 17 to 23 (ESMA, 2026; EUR-Lex, 2022). A denied-action alert is the kind of event an incident classification process must be able to find. Research on which SOC 2 controls apply to AI agents maps the record to the Trust Services Criteria, used "to evaluate and report on controls over the security, availability, processing integrity, confidentiality, or privacy" (AICPA, 2023).

What do the vendors themselves say?

Both vendors document the ingestion path for custom data in detail and are silent, in the pages reviewed, on AI agent records as a category. That is expected: to the SIEM, an agent record is one more custom source.

Dimension Microsoft Sentinel, per its documentation CrowdStrike Falcon Next-Gen SIEM, per its documentation What a buyer should verify
Ingestion path Logs Ingestion API, POST to a DCR stream (Microsoft, 2026) HEC data connector over HTTP or HTTPS (CrowdStrike, 2026) Which path the exporting environment supports
Authentication Bearer token from an app registration with Monitoring Metrics Publisher on the DCR API key shown once on the connector's detail page How the credential reaches the exporter
Schema Custom table with _CL suffix; column names up to 45 characters Parser mapping to ECS-based names under CPS (CrowdStrike, 2026) Field mapping for token, page, approver
Pre-storage shaping DCR transformations in KQL: filter, enrich, mask (Microsoft, 2026) Parsing stage extracts fields and tags Whether shaping is needed for a token-only record
Agent-record guidance Not described in the pages reviewed Not described in the pages reviewed Ask each vendor for reference content

The practical reading is that neither platform imposes a limit specific to agent records. Microsoft's filtering charge on Basic tables and the 45-character column limit shape the schema; CrowdStrike's one-time key display and role requirements shape the setup. Everything about what the record should contain is decided by the environment that produces it.

What does a governed environment change?

In a governed environment, the record that reaches Sentinel or Falcon contains the screens as tokens, the actions and the approvers, so a security team gets a complete per-run account of an agent's work without receiving a single customer value.

The mechanism is a class of control that sits between the rendered page and the model. Sensitive values on the screen, including account numbers and names on a payments operations console, are replaced with consistent tokens before any model reads them, and the task runs on those tokens. The real value resolves only at the approved destination at the moment of an approved action. A named person confirms what is tokenized and approves consequential actions, including a payment release or a record change. Every screen as the model received it, in token form, every action and every approval is recorded and exported to the organization's own logging, which here is the SIEM.

This bears on the title question because the export is only as safe as the record. A record produced by capturing what an ungoverned agent read would carry the account numbers into the SIEM, where Sentinel's transformations could mask them after arrival (Microsoft, 2026) but only after they had crossed the wire. A record produced by an environment that tokenized the screen never holds them, so the ingestion step, the parser and the analytics rule all operate on evidence rather than on regulated data. The record remains metadata: it states what the model received and did, and does not reproduce everything the model observed. Research on what an AI Control Record is describes the record's fields.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. Agents work inside a governed environment in the customer's own cloud. On every rendered page, including a payments operations console or a customer account screen, substitution happens at the render layer before any model reads the screen, so values reach the model as consistent tokens such as ACCT_001 or CUST_001 for the whole run. Real values resolve only at approved destinations at the moment of an approved action. A named person confirms the tokenization policy and approves every payment, submission and record change, the arrangement RedactSure calls Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM, which for the two platforms on this page means the Logs Ingestion API path into Sentinel or the HEC path into Falcon Next-Gen SIEM, with the record's fields mapped by the customer's parser. The design is model agnostic, requires no per-application integration, and leaves user permissions unchanged.

Deployments are in pilot. A pilot on the reader's own workflow would show the per-run record arriving in the reader's workspace, the analytics rule firing on a denied action, and the approval events for each confirmed change. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on Microsoft Learn documentation for the Azure Monitor Logs Ingestion API and for custom data ingestion and transformation in Microsoft Sentinel, CrowdStrike Developer Center documentation for HEC data ingestion and the CrowdStrike Parsing Standard, Microsoft's Purview documentation on audit logs for Copilot, the Chan et al. preprint on visibility into AI agents, the AICPA Trust Services Criteria, the text and ESMA's summary of Regulation (EU) 2022/2554 (DORA), and published RedactSure research pages on agent access records, SOC 2 controls, agent auditing, render-layer tokenization and the AI Control Record. All sources were read as of October 16, 2026.

No hands-on testing of Sentinel, Falcon Next-Gen SIEM or any other product was performed for this page, and no ingestion was run. The export described is metadata, not a recording of everything the model observed: it holds the token view of each screen, the actions and the approvers, and does not hold the real values, screenshots, full page text or the model's reasoning, so a reviewer should not expect it to reconstruct the page as a person saw it. Where a capability is described as not described, the statement means not described in the pages reviewed. The EUR-Lex pages for DORA returned only metadata through the tools used, so the scope and incident-reporting description is taken from ESMA's summary. Vendor features change, and ingestion limits and pricing in particular, so the page carries its date. Statements about RedactSure describe its current design, with deployments in pilot. The payments operations console and the analytics rule describe record types, not any organization.

Whether a given export and detection set meets an organization's obligations under DORA, SOC 2, GLBA or its own logging policy is a determination for its counsel, its assessors and its own security and compliance officers, not for a research page.

What the record shows

Both platforms document a path for custom-format data: Sentinel through the Logs Ingestion API and a data collection rule into a custom table, Falcon through an HEC connector and a parser mapped to the Elastic Common Schema. Neither documents AI agent records as a category, and neither needs to, because the record is one more custom source once its schema is fixed. The decisions that matter are made upstream: whether the record holds tokens or values, whether it records approvers, and whether denied actions are events a rule can find. An export from an environment that tokenized the screen, such as RedactSure's, carries evidence rather than regulated data, and remains metadata about what the model received and did rather than a recording of all it observed. The test is to name one agent and one task, send one run's record to the workspace, and ask whether an analyst can see the denied action, the approver and the page as the model received it without seeing one customer value.

Frequently asked questions

Does the record contain everything the agent saw?

No. The export is metadata: the page as the model received it with each sensitive field shown as its token, the actions taken, their outcomes and the named approver. It does not contain the real values, screenshots, the full text of each page or the model's reasoning. A reviewer can establish what the model received and did from it, and cannot reconstruct the page as a person would have seen it. That limit is deliberate, since the alternative makes the SIEM a store of regulated data.

Which Sentinel table should the record use?

A custom table, which Microsoft requires to carry the _CL suffix, created to match the data collection rule's stream declaration. Microsoft states that the Logs Ingestion API supports custom tables and selected Azure tables, and that column names are limited to 45 alphanumeric characters and underscores. A dedicated table keeps the agent record separate from application audit logs, which simplifies both the analytics rules and the retention setting applied to it.

Why does CrowdStrike require a parser for this source?

Because the Parsing Standard normalizes third-party data to Elastic Common Schema based field names, and CrowdStrike states that for sources without a built-in connector you must provide parsers and mappings. Extracting fields at the parsing stage is what makes the record searchable alongside endpoint and identity telemetry. The agent record's run identifier, agent identity, action, outcome and approver each need a mapping; token, page and field stay as vendor-specific fields.

What is the first analytics rule to write?

A rule on denied actions joined to approvals for the same run. A denied action shows the policy working and tells the team what the agent attempted outside its task. A consequential action with no approval event in the same run is the alert that matters, because it means a payment, submission or record change happened without the named person the policy requires. Drift in pages or record types read is a useful second rule.

Can Sentinel's transformations mask values after they arrive?

Yes; Microsoft documents KQL transformations in the data collection rule that filter, enrich or mask incoming data before storage. For a record that already contains only tokens there is nothing to mask. For a record captured from an ungoverned agent, masking at the DCR happens after the values have crossed the wire and reached Azure Monitor, so it reduces what is stored but not what was transmitted. The decision belongs where the record is produced.

How does the record help with DORA incident reporting?

ESMA describes DORA's ICT-related incident management and reporting obligations in Articles 17 to 23, covering the handling of incidents and notification of supervisors about major ones. A SIEM that holds per-run agent records with denied actions and approvals gives an incident classification process a place to find agent-related events and a timeline to attach to them. Whether a given event is a reportable incident is a determination for the entity's compliance function.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.