ContraForce Integration with Microsoft Sentinel

Reviewed by ContraForce Security Operations Team · Updated 2026-08-12

The ContraForce integration with Microsoft Sentinel applies governed investigation and response procedures to eligible Sentinel incidents across customer workspaces. Sentinel remains the SIEM and automation surface. ContraForce supplies the multi-tenant delivery workflow, agent execution, approvals, evidence, and service records.

Integration boundary

System	Responsibility
Microsoft Sentinel	SIEM data, analytics, incidents, automation rules, and Logic Apps playbooks
ContraForce	Gamebook-governed investigation, response authority, cross-customer operations, ticketing, reporting, and tuning workflow
Human operator	Policy, approval, exception handling, customer communication, and accountability

Microsoft describes Sentinel playbooks as workflows based on Azure Logic Apps. They can run automatically or on demand and interact with internal and external systems. See Automation in Microsoft Sentinel.

Delivery flow

A Sentinel analytics rule or connected Microsoft signal produces an incident.
ContraForce receives the incident from the configured customer workspace.
A Security Delivery Agent follows the assigned Gamebook and gathers approved evidence.
The agent records the verdict and selects actions permitted by the procedure.
ContraForce can invoke supported native or external actions, subject to approval gates.
The platform records the outcome and synchronizes the service workflow.

Deployment checklist

Confirm the customer's Sentinel workspace and Defender portal onboarding state.
Validate delegated access and the minimum required roles.
Inventory analytics rules, automation rules, and Logic Apps playbooks.
Identify the primary workspace for unified security operations.
Map incident classes to Gamebooks and customer-specific approvals.
Test the service ticket and evidence output.
Revalidate the workflow after Microsoft portal or automation changes.

Portal transition

Microsoft states that Sentinel will no longer be supported in the Azure portal after March 31, 2027. Providers should test automation from the Defender portal and account for the documented differences in rule and playbook behavior.

Sources and review method

Product capabilities were reviewed against primary sources on 2026-08-12. ContraForce performance figures are product telemetry, not independent industry benchmarks.