# Send logs to Microsoft Sentinel

**URL:** <https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176>\
**Category:** Zoom Apps\
**Tags:** webhooks\
**Created:** [March 5, 2023, 7:31am UTC](https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176 "2023-03-05T07:31:50Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![yahavb](https://avatars.discourse-cdn.com/v4/letter/y/e495f1/32.png) [@yahavb](https://devforum.zoom.us/u/yahavb)\
**Post date:** [March 5, 2023, 7:31am UTC](https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176/1 "2023-03-05T07:31:50Z")

</div>

Hi there,

I created an app (JWT) as recommended to send logs from zoom to our SIEM (microsoft sentinel).  
from some reson the URL validation always faild no matters what URL i provided. - issue 1 .  
However we recived logs to our SIEM, but as a reports and not as single log like signin to Zoom by a single user.

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [March 8, 2023, 1:47am UTC](https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176/2 "2023-03-08T01:47:34Z")

</div>

Just to be clear, you are using Webhooks with a JWT app and are having issues validating the URL, correct?

Please see our documentation on this to start:

[https://marketplace.zoom.us/docs/api-reference/webhook-reference/#validate-your-webhook-endpoint](https://marketplace.zoom.us/docs/api-reference/webhook-reference/#validate-your-webhook-endpoint)

You may find this example application to be useful when implementing validation:

> **[GitHub - zoom/webhook-sample-node.js: Receive Zoom Webhooks](https://github.com/zoom/webhook-sample-node.js)**
>
> Receive Zoom Webhooks. Contribute to zoom/webhook-sample-node.js development by creating an account on GitHub.

Let me know if that helps!

---

<div class="post-metadata">

**Author:** ![yahavb](https://avatars.discourse-cdn.com/v4/letter/y/e495f1/32.png) [@yahavb](https://devforum.zoom.us/u/yahavb)\
**Post date:** [March 9, 2023, 11:24am UTC](https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176/3 "2023-03-09T11:24:07Z")

</div>

Yes i’m using the Webhook JWT.  
I’m not sure is the right way to that, becouse brfore we used with the Webhook Only  
and the issue was the same.  
Maby you have recommendation what kind of app we need to use to send Zoom logs to our Microsoft Sentinel SIEM.

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [March 9, 2023, 10:46pm UTC](https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176/4 "2023-03-09T22:46:24Z")

</div>

Either app type should work the same when it comes to validating and using a webhook. However, I recommend using a Webhook-only app as we are working to deprecate JWT app types in the near future. More information can be found [here](https://marketplace.zoom.us/docs/guides/build/jwt-app/#create-a-jwt-app--omit-in-toc-).

---

<div class="post-metadata">

**Author:** ![yahavb](https://avatars.discourse-cdn.com/v4/letter/y/e495f1/32.png) [@yahavb](https://devforum.zoom.us/u/yahavb)\
**Post date:** [March 12, 2023, 2:06pm UTC](https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176/5 "2023-03-12T14:06:57Z")

</div>

Thank Max,  
We will try it and keep you posted on the result

---

<div class="post-metadata">

**Author:** ![yahavb](https://avatars.discourse-cdn.com/v4/letter/y/e495f1/32.png) [@yahavb](https://devforum.zoom.us/u/yahavb)\
**Post date:** [March 12, 2023, 2:12pm UTC](https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176/6 "2023-03-12T14:12:14Z")

</div>

Max,  
can you provide us the documentations to connect Zoom logs to Microsoft Sentinl (SIEM) via Webhook only pleaes?

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [March 20, 2023, 8:23pm UTC](https://devforum.zoom.us/t/send-logs-to-microsoft-sentinel/84176/7 "2023-03-20T20:23:35Z")

</div>

Here is a guide from Microsoft that should help out:

> **[Monitoring Zoom with Azure Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/monitoring-zoom-with-azure-sentinel/ba-p/1341516)**
>
> In a recent blog we talked about the explosion in usage we had seen with Microsoft Teams as the world has moved to working from home. However, Microsoft Teams is not the only application to see such as surge, Zoom is another remote productivity...

Let me know if you have any further questions.
