You already run AWS for the application stack and Microsoft Sentinel as the SIEM. IntentGate sits inline in front of agent tool servers and emits an audit event for every decision. Both lanes of the existing log pipeline receive those events without schema invention or SOC retraining.
Reference topology
One gateway, two independent audit lanes. Sentinel handles the live operational view; S3 and Athena preserve the long-term, queryable record.
Microsoft Sentinel forwarder
The gateway includes a native Sentinel emitter targeting the modern Logs Ingestion API. It batches events, authenticates with an Azure AD service principal, and sends them to a Data Collection Endpoint routed through a Data Collection Rule.
Provision the custom table IntentGate_CL in the Log Analytics workspace. The shipped KQL assumes this table name, and INTENTGATE_SIEM_SENTINEL_STREAM takes the prefixed stream name Custom-IntentGate_CL.
Create the Data Collection Endpoint and Data Collection Rule.
Create an Azure AD service principal and grant it the Monitoring Metrics Publisher role on the DCR.
Set the six environment variables on the gateway pod and restart.
Gateway environment variables
INTENTGATE_SIEM_SENTINEL_DCE_URL
INTENTGATE_SIEM_SENTINEL_DCR_ID
INTENTGATE_SIEM_SENTINEL_STREAM
INTENTGATE_SIEM_SENTINEL_TENANT_ID
INTENTGATE_SIEM_SENTINEL_CLIENT_ID
INTENTGATE_SIEM_SENTINEL_CLIENT_SECRETGET /v1/admin/integrations and confirm the sentinel integration has a recent last_flush_ts and non-zero total_events. This endpoint reports Splunk, Datadog and Sentinel only, so verify the S3 sink by listing objects in the bucket.Native Amazon S3 sink
Gateway v1.7+ writes batched audit events as gzipped NDJSON. Objects are stored beneath a Hive-style partition tree, year=YYYY/month=MM/day=DD/hour=HH, and inherit the bucket’s default encryption.
Provision the bucket and apply the sample lifecycle policy.
Grant the gateway pod IRSA or instance-role access using the sample IAM policy.
Set the required environment variables and restart the pod.
Minimum configuration
INTENTGATE_SIEM_S3_BUCKET=my-audit-bucket
INTENTGATE_SIEM_S3_REGION=eu-west-1 # optional, else resolved from AWS_REGIONOptional settings include INTENTGATE_SIEM_S3_PREFIX, INTENTGATE_SIEM_S3_KMS_KEY_ID, and INTENTGATE_SIEM_S3_GATEWAY_ID. The complete configuration surface is documented in the S3Config source.
Athena Glue table
Run one CREATE EXTERNAL TABLE statement in Athena to register the audit schema in Glue. Partition projection lets Athena infer partitions from the prefix structure without daily MSCK REPAIR jobs.
The DDL ships with the gateway alongside the audit schema:
deploy/athena/intentgate_audit.sql →
aws athena start-query-execution \
--query-string "$(cat deploy/athena/intentgate_audit.sql)" \
--result-configuration "OutputLocation=s3://your-query-results/"KQL starter pack
The included KQL queries answer the operational questions IntentGate audit data supports directly: denied calls, escalations, policy failures by rule, latency p95, and more.
Copy any
.kql file into Sentinel’s Logs blade. Queries assume the IntentGate_CL table and the gateway’s default field mapping.Compliance reporting
The two lanes answer different assurance questions:
- Sentinel provides live monitoring and a 12-month operational view.
- S3 and Athena provide multi-year, queryable retention for BIO, ISO 27001, and EU AI Act reporting.
GET /v1/admin/audit/verify answers “has the chain been tampered with?” Athena answers “what happened?” Treat them as complementary controls.