Changelog · Sep 2, 2026 — Latest Changes

Microsoft Sentinel Integration

The Spur: IP Intelligence and Enrichment solution enriches public IP addresses associated with Microsoft Sentinel incidents using the Spur Context API.

This guide covers how to install the Spur solution, deploy the custom connector, create the enrichment playbook, configure and authorize its connections, enable automatic enrichment, and test the integration.

You can complete installation through the Microsoft Defender portal or the Microsoft Azure portal.

---

Prerequisites

---

Install the Spur solution

1. Open the Spur Microsoft Sentinel solution and select Get it now.
2. Follow the prompts to install the solution in your Microsoft Sentinel workspace.
3. In the Azure portal, search for and open Microsoft Sentinel.
4. Select your workspace, then go to Content management → Content hub.
5. Search for Spur, open Spur: IP Intelligence and Enrichment, and select Manage.

For more information, see Discover and manage Microsoft Sentinel content.

---

Deploy the Spur custom connector

The Spur custom connector must be deployed before you create the enrichment playbook.

1. From the Spur solution management page, locate Spur IP Enrichment Incident Trigger.
2. Select the playbook template, then select Configuration.
3. Under Prerequisites, select Deploy Custom connector to Azure.
4. Select the Azure subscription and resource group used by your Microsoft Sentinel workspace.
5. Review the deployment settings:

6. Confirm the workspace exists in the selected subscription and resource group.
7. Select Review + create, wait for validation, then select Create.
8. Wait for the deployment to finish before returning to Microsoft Sentinel.

Expected result

The deployment creates:

• The Spur custom connector
• A Data Collection Rule
• A Data Collection Endpoint
• The resources required to connect the integration to your Log Analytics workspace

If the deployment reports a failure

Open Deployment details and review each resource individually. The overall deployment may report a failure even if some resources were created successfully — resolve any failed resources before creating the playbook.

---

Confirm the custom connector exists

Before creating the playbook:

1. Open the deployment details.
2. Confirm the Spur custom connector was created successfully.
3. Confirm its name matches the Spur Connector Name entered during deployment.
4. Note the connector name — you'll need it when creating the playbook.

---

Create the enrichment playbook

1. Return to Microsoft Sentinel → Content management → Content hub.
2. Open Spur: IP Intelligence and Enrichment, then select Manage.
3. Select Spur IP Enrichment Incident Trigger, then select Create playbook.
4. On the Basics tab, select your Azure subscription and the same resource group used for the custom connector, confirm the playbook name, and enable diagnostic logs if required.
5. Select Next: Parameters and confirm that SpurConnectionName matches the name of the Spur custom connector deployed earlier.
6. Select Next: Connections.

For more information, see Create and customize Microsoft Sentinel playbooks from templates.

---

Configure the connections

The playbook uses two connections:

1. On the Connections tab, expand Spur Context Connector.
2. Create or select your Spur API connection, and enter your Spur API token when prompted.
3. Confirm the Microsoft Sentinel connection will use the playbook's managed identity after deployment.
4. Select Next: Review and create, review your configuration, then select Create playbook.

---

Authorize and verify the connections

After creating the playbook, confirm both connections are active.

1. Open the newly created Logic App and select Overview.
2. Confirm the workflow is enabled.
3. Go to Development Tools → Logic app designer and confirm the workflow contains the Microsoft Sentinel incident trigger, the actions that collect IP entities, the Spur enrichment actions, and the actions that return enrichment information to the incident.
4. Look for any actions displaying a warning or authentication error.

Authorize the Spur connection

If the Spur connection requires authorization:

1. Select the affected Spur action.
2. Create or select your Spur API connection.
3. Enter your Spur API token and confirm the connection.

Authorize the Microsoft Sentinel connection

If the Microsoft Sentinel connection reports a permissions error:

1. Confirm the Logic App's managed identity is enabled.
2. Grant the identity the Microsoft Sentinel permissions required for your environment — this commonly includes the Microsoft Sentinel Responder role at the appropriate workspace or resource-group scope.
3. Return to the Logic App designer and select Save.

---

Configure automatic enrichment

Creating the playbook does not automatically run it for every incident — create an automation rule to run it when the required conditions are met.

1. In Microsoft Sentinel, go to Configuration → Automation.
2. Select Create → Automation rule and enter a name, such as Run Spur IP enrichment.
3. Configure the incident conditions that should trigger the playbook.
4. Under Actions, select Run playbook and select your Spur incident-enrichment playbook.
5. Review the rule order and expiration settings, then save and enable the automation rule.

For more information, see Automate threat response with Microsoft Sentinel playbooks.

---

Test the integration

1. Open or create a test incident containing at least one valid public IP address entity.
2. Let the automation rule trigger the playbook, or run it manually from the incident's available actions.
3. Open the deployed Logic App and select Run history, then open the relevant playbook run.
4. Confirm the Microsoft Sentinel incident was received, at least one IP entity was found, the Spur enrichment action completed successfully, and the enrichment information was returned to the incident.
5. Return to the Microsoft Sentinel incident and confirm the Spur enrichment information appears in the incident output or comments.

---

Troubleshooting

Connector 'Spur-Context-Connector' not found

This means the playbook cannot find the required Spur custom connector.

1. Cancel the playbook deployment.
2. Return to the Spur playbook template and select Configuration, then Deploy Custom connector to Azure.
3. Deploy the connector in the same subscription and resource group used for the integration.
4. Confirm the deployed connector name matches SpurConnectionName.
5. Return to the template and create the playbook again.

Spur Context Connector is unavailable

If the connector is greyed out or cannot be selected, confirm that:

• The custom connector deployment completed successfully.
• You are creating the playbook in the correct subscription and resource group.
• The connector name matches SpurConnectionName.

Refresh the playbook template after the connector deployment completes, or cancel and restart the playbook deployment if necessary.

The workspace fails to deploy

Confirm that:

• Workspace Name contains the name of your existing Log Analytics workspace.
• The workspace is connected to your Microsoft Sentinel deployment.
• The workspace exists in the selected Azure subscription and resource group.
• You replaced the example spur-log-workspace value.
• You have permission to access and update the workspace.

Spur does not require a separate Spur-owned Log Analytics workspace.

The Data Collection Rule or Data Collection Endpoint fails

Confirm that:

• The Log Analytics workspace exists and its name is entered correctly.
• The DCR and DCE names are valid and don't conflict with existing resources.
• The selected region supports the required resources.
• You have permission to create Data Collection Rules and Data Collection Endpoints.

Open Deployment details to identify whether the DCR, DCE, or another dependent resource failed.

The Spur connection is inactive

1. Open the deployed Logic App and go to Development Tools → Logic app designer.
2. Select the Spur action displaying the warning.
3. Create or reauthorize your Spur API connection.
4. Confirm your API token is correct, belongs to an active Spur Context API subscription, and that SpurConnectionName matches the deployed custom connector name.
5. Save the workflow and run another test.

Microsoft Sentinel reports a permissions error

1. Confirm the Logic App's managed identity is enabled.
2. Grant the managed identity the appropriate Microsoft Sentinel role at the required workspace or resource-group scope.
3. Confirm Microsoft Sentinel has permission to run the playbook.
4. Save the workflow and run another test.

The playbook does not run automatically

Confirm that:

• You created and enabled an automation rule.
• The automation rule conditions match your test incident.
• The rule includes the Run playbook action with the correct Spur playbook selected.
• Microsoft Sentinel has permission to run the playbook.
• The automation rule has not expired.

The playbook runs but no enrichment appears

Confirm that:

• The incident contains a valid public IP entity that the workflow extracted successfully.
• The Spur API connection is active and your Spur API token is valid.
• Your subscription has remaining Context API usage.
• The Logic App run completed successfully.

Open Run history and inspect any failed action for its error response.

The enrichment heading contains a spelling error

Some earlier versions of the playbook contain a spelling error in the enrichment heading.

1. Open the deployed Logic App and select Code view.
2. Locate the misspelled enrichment heading and correct it to Enrichment.
3. Save the workflow.

This only changes the wording displayed in the enrichment output.

---

Contact Spur Support

If the connection or enrichment action continues to fail, contact Spur Support with:

• The name of the failed Azure resource or Logic App action
• The error shown in Deployment details or Run history
• The Azure region used for the deployment
• Whether the custom connector deployed successfully
• Whether both connections appear active
• Whether the playbook succeeds when run manually
• Whether you configured an automation rule

---

Related

• Context API Overview
• Context API Integrations
• Spur Microsoft Sentinel solution — View in Microsoft Marketplace
• Spur solution files — Microsoft Azure-Sentinel repository