The RAPTOR AI connector for Microsoft Sentinel allows security teams to automatically ingest email threat alerts from the RPost PRE-Crime™ platform. The connector polls and stores every 5 minutes all red, yellow, and green risk alerts generated by the organizations’ account into the RaptorAlerts_CL custom table of the Sentinel workspace.
This guide walks through the complete setup process:
• Pre-requisites
• Deploying the connector to your Azure environment
• Connecting the connector with your API credentials
• Setting up the threat intelligence workbook in Microsoft Defender
Pre-requisites
- An active Microsoft Sentinel workspace in your Azure subscription.
- Owner or Contributor permissions on the Azure resource group where Sentinel is deployed.
- Microsoft Sentinel Contributor role in the Sentinel workspace.
- The connector ARM template file (raptor-sentinel-connector.json) provided by RPost.
- Your RAPTOR AI API Client ID and Client Secret provided by RPost.
Note: The ARM template and API credentials are provided by RPost. Contact your RPost account representative if you have not received these yet.
Deploying the connector to your Azure environment
The connector is deployed as an ARM template directly from the Azure Portal. This step creates the connector definition, the custom table (RaptorAlerts_CL), and the data pipeline in your Sentinel workspace.
1. Go to the Azure Portal and sign in with your administrator account.
2. In the search bar at the top, type Deploy a custom template and select it from the results.
3. On the Custom deployment page, click Build your own template in the editor.
4. In the template editor, delete all existing content.
5. Open the raptor-sentinel-connector.json file provided by RPost in any text editor (Notepad, VS Code, etc.).
6. Select all the content (Ctrl+A) and copy it (Ctrl+C).
7. Paste it into the Azure template editor.
8. Click Save.
After saving the template, you will be taken to the deployment parameters page. Fill in the following:
| Parameter | Value | Notes |
| Subscription | Your Azure subscription | Select from dropdown. |
| Resource Group | Your Sentinel resource group | Must be the group containing your Sentinel workspace. |
| Region | Your resource group region | Select the region where your resource group is. |
| Location | [resourceGroup().location] | Complete as indicated. |
| Workspace | Your Log Analytics workspace name | Exact name of the workspace where Sentinel is enabled. |
| Workspace Location | e.g. eastus | Azure region of your workspace. Must match exactly. |
| Resource Group Name | [resourceGroup().name] | Complete as indicated. |
| Subscription | [last(split(subscription().id, '/'))] | Complete as indicated. |
| Data Collection Endpoint Name | Leave empty. |
9. Click Review + create.
10. Review the summary and click Create.
11. Wait for the deployment to complete. You will see a Deployment succeeded notification pop-up when done.
Note: If the deployment fails, check that the workspace name and location match your actual Sentinel workspace exactly. These are case-sensitive.
Connecting the connector with your API credentials
Once the ARM template is deployed, you need to activate the connector by entering your RAPTOR AI API credentials. This step creates the active polling connection that will fetch alerts every 5 minutes.
1. Go to the Microsoft Defender portal.
2. In the left navigation, go to Microsoft Sentinel.
3. Go to Configuration → Data connectors.
4. Click on the RAPTOR AI Alerts connector from the list.
5. Click Open connector page.
6. On the connector page, enter the Client ID and Client Secret fields with the values provided by RPost.
7. Click Connect.
8. Wait approximately 30 seconds. The connector status will change to Connected.
Note: Your Client ID and Client Secret are unique to your organization and are provided by your RPost account representative. Do not share these credentials.
Setting up the threat intelligence workbook in Microsoft Defender
RPost provides a pre-built workbook that gives your security team a visual dashboard for monitoring RAPTOR AI alerts. The workbook includes KPI tiles, geographic alert analysis and reconnoitered email tracking.
1. In the Defender portal, go to Microsoft Sentinel → Threat management → Workbooks.
2. Click + Add workbook.
3. A blank workbook opens in edit mode.
4. In the workbook toolbar, click Edit, then Advanced Editor.
5. Delete all existing content in the editor.
6. Open the raptor-workbook.json file provided by RPost in any text editor.
7. Select all the content (Ctrl+A), copy it (Ctrl+C), and paste it into the Advanced Editor.
8. Click Apply.
9. Click Done Editing, then click Save.
10. Enter a name for the workbook. Suggested: RAPTOR AI PRE-Crime - Threat Overview.
11. Select your workspace and location.
12. Click Save.
The workbook is now available at:
Microsoft Sentinel → Threat management → Workbooks → My workbooks → RAPTOR AI PRE-Crime - Threat Overview
Pre-built Workbook Features
- Time range filter and risk level filter at the top of the workbook.
- KPI tiles showing red, yellow, and green alert counts and total emails under surveillance.
- Alert trend chart showing activity over time by severity.
- Geographic threat breakdown: countries of origin for suspicious opens.