Search code examples
azureazure-log-analyticsazure-sentinel

Azure Sentinel: How to convert the existing log analytics as Azure Sentinel workspace?

I have a centralized log analytics workspace to which all the logs are being sent including:

  1. Activity Logs 
  2. Network Logs 
  3. Resource Logs 
  4. System Metrics 
  5. Application Logs 
  6. Application Insights

Now, I want to use this log analytics workspace as a sentinel workspace so that I don't have to connect the individual resources.

Is this achievable? If so, how?

Solution

  • Yes, a centralized log analytics workspace can be used as a Sentinel workspace to expedite log analysis and monitoring without having to connect to different resources separately.

    To achieve this, create a Microsoft sentinel in the portal, link the workspaces that need to be linked while creating the sentinel, and enable UEBA. as detailed in MSDoc.

    To enable this, go to Microsoft sentinel -> configuartion -> settings. you need to have either a global administrator or a security administrator privilege as shown.

    enter image description here

    To connect the workspace logs to sentinel, scroll to Data connectors then search for Azure activity logs that need to be linked with sentinel. Then as shown, it redirects you to the connector page.

    enter image description here

    Once it is done, you can create workbooks and analytic rules which allows you to create a dashboard to visualize data and notify security alerts.

    You can also query the individual workspace logs linked to the Sentinel as shown below.

    enter image description here

    enter image description here

    Refer these Microsoft sentinel & Microsoft Q&A for more relevant approaches for this requirement.