cds-snc/Forward github action data to Sentinel
Import data from a previous action into Microsoft Sentinel tables. Supports both the Logs Ingestion API (v2) and the legacy Data Collector API (v1).
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 11, 2026
- License
- MIT
Pinned Snippet
uses: cds-snc/sentinel-forward-data-action@e358bf24b818e68a22c9736715a3b544851aaba8 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| file_name | File that contains a list of outputs to be imported into the workspace | no | — |
| input_data | Data from a previous action to be imported into the workspace | no | — |
| dce_endpoint | The Data Collection Endpoint (DCE) or DCR logs ingestion endpoint URL | no | — |
| dcr_rule_id | The immutable ID of the Data Collection Rule (DCR) | no | — |
| stream_name | The stream name in the DCR that represents the destination table (e.g. Custom-MyTable) | no | — |
| azure_client_id | The Azure AD application (client) ID for authentication | no | — |
| azure_tenant_id | The Azure AD tenant ID for authentication | no | — |
| azure_client_secret | The Azure AD client secret (optional, omit to use GitHub OIDC federated credentials) | no | — |
| log_analytics_workspace_id | The Log Analytics workspace ID | no | — |
| log_analytics_workspace_key | The Log Analytics workspace shared key | no | — |
| log_type | The name of the custom log table (without the _CL suffix) | no | — |
Outputs
no outputs