Verification and Testing

After connecting, allow 15–20 minutes for the first batch of events to land in the Log Analytics workspace.

Validate the Data Flow

Before validating data flow to Sentinel, first verify that ESKM is generating and forwarding logs to the data connector. This validation process confirms the complete data pipeline: from KMIP server logging through the Management API to Sentinel ingestion.

1. Navigate to ESKM Management Console → Device → Logs & Statistics → Log Viewer → KMIP.

2. Verify that KMIP events are being logged (authentication, operations, access attempts, etc.)

3. If no events appear, generate test traffic (e.g., a KMIP authentication or key operation) and verify it appears in the log viewer.

Once you've confirmed KMIP logging is active, run the following queries in Microsoft Sentinel → Logs to validate data ingestion into Sentinel.

Rows Are Arriving

This query verifies that the Microsoft Sentinel connector is actively ingesting logs from Utimaco ESKM. It checks whether events have been received within the last hour and provides a summary of the total number of events along with the most recent ingestion timestamp.

UtimacoESKMKmipServerLogs_CL| where TimeGenerated > ago(1h)| summarize Events = count(), LastSeen = max(TimeGenerated)

The query returns at least one row with a recent LastSeen timestamp. If no rows are returned after 30 minutes, refer to Troubleshooting.

Sample Events

This query retrieves a sample set of up to 100 events ingested in the last 24 hours. It allows you to inspect the raw log records generated by ESKM and verify that the data is being correctly parsed and stored in the custom Sentinel table.

UtimacoESKMKmipServerLogs_CL| where TimeGenerated > ago(24h)| take 100

These logs typically include fields such as event type, operation, user, result, and timestamps, which are mapped during ingestion. When reviewing the sample events, verify that all expected columns are populated with meaningful data, that timestamps are recent and accurate, and that user and IP information is correctly captured.

Event Distribution

This query provides a breakdown of events by type (e.g., authentication, key operations). It helps validate that different categories of ESKM activities are being ingested and that the connector is not restricted to a single event type.

UtimacoESKMKmipServerLogs_CL
| summarize count() by Event
| order by count_ desc

Review the results to identify the distribution of different KMIP event types in your environment. Expected event types include Authentication, Get, Create, Destroy, and StateChange operations. If you notice that certain expected operations (such as Destroy) have zero or significantly lower counts than anticipated, this may indicate a logging configuration issue or that those operations are not being performed during the monitoring period. A healthy data flow should show a balanced distribution of events representing the normal operations on your KMIP plane.

Connector Health Status

This step verifies the operational health of the data connector. It ensures that the connector is successfully authenticated, actively polling the ESKM API, and sending logs to Sentinel.

Navigate to Configuration → Data connectors → Utimaco Enterprise Secure Key Manager (ESKM).

In the connector details, verify the following:

• Status should display Connected (indicating successful authentication and API communication).

• Last Data received should show a recent timestamp (typically within the last 10–15 minutes, depending on your polling interval).