Before
A security operator likely had to log in to the Sentinel dashboard, review whether an alert subscription was still active, and renew or recreate it before expiration. The operator also depended on manually checking that alert notifications were being delivered to the downstream webhook process.
How it works
- A scheduled run retrieves the existing Sentinel alert subscriptions and calculates a new seven-day expiration time.
- The workflow checks whether an ongoing subscription exists, then renews that subscription or creates a new one for new security alerts.
- Sentinel posts subsequent alert notifications to the configured webhook, where downstream parsing and specialized dispatch can continue.
Workflow details
- Scheduled maintenance: A predetermined schedule starts the workflow daily or one or more times per week, allowing subscription coverage to be maintained before the limited subscription lifetime expires.
- Subscription review: The workflow lists the existing alert subscriptions and calculates a new expiration time seven days from the current run, while retaining the configured webhook destination.
- Automated decision: If an ongoing subscription is found, the workflow updates its expiration date. If no ongoing subscription exists, it creates a subscription for new security alerts using the configured webhook notification URL.
- Alert delivery: The subscription monitors the security alert resource for alerts with a new-alert status and posts subsequent notifications to the webhook, where they can be parsed and dispatched to specialized subflows.
- Operational result: Subscription creation and renewal become scheduled maintenance activities rather than recurring dashboard checks, supporting continuous alert monitoring within Microsoft Sentinel's maximum 30-day subscription lifetime.
What changed
Subscription maintenance now occurs automatically on a recurring schedule. The workflow performs the existence check and renewal-or-creation decision, while alert notifications are delivered to the webhook for downstream processing instead of requiring a person to repeatedly review the Sentinel dashboard.
Work removed
Logging in to the Sentinel dashboard, listing subscriptions, checking whether an ongoing subscription exists, calculating renewal dates, renewing or recreating an expired subscription, and manually confirming the webhook subscription is in place.
Expected outcome
At least one recurring subscription review and renewal-or-creation decision is automated per scheduled run, supporting uninterrupted alert subscription coverage within the seven-day renewal window.
