Sentinel migration

Hi Victor1989,

I have no knowledge of Sentinel, but I can tell you how to migrate data from LogAnalaytics 😉

You can export data from one Log Analytics workspace and import it into another workspace.

Here’s how:

1. Export Data:

   • In the source Log Analytics workspace, export the data you want to move. You can use the export operator in KQL (Kusto Query Language) to extract specific data.
   • Save the exported data in a compatible format (e.g., CSV, JSON).

2. Import Data into New Workspace:

   • In the target Log Analytics workspace, use the ingest inline operator in KQL to load the exported data.
   • Ensure that the schema and data types match between the source and target workspaces.

3. Query and Use Data:

   • Once imported, you can query and analyze the data in the new workspace.
   • Create custom queries, alerts, and dashboards as needed.

Remember to validate the data after importing and adjust any custom logic or configurations. 

You can also automate the data export and import process using Azure Automation or other scripting tools.

Here’s how:

1. Automating Data Export:

   • Create an Azure Automation Runbook or a custom script.
   • Schedule the runbook/script to periodically export data from the source Log Analytics workspace.
   • Use the https://learn.microsoft.com/en-us/rest/api/loganalytics/data-exports/create-or-update?view=rest-loganalytics-2023-09-01&tabs=HTTP or PowerShell cmdlets to retrieve data based on your criteria (e.g., specific tables, time range).
   • Save the exported data to a storage account or a file share.

2. Automating Data Import:

   • In the target Log Analytics workspace, create another runbook or script.
   • Schedule it to run at intervals.
   • Use the ingest inline operator in KQL to load the exported data into the new workspace.
   • Validate the data after import.

If the information has helped you, I would appreciate a like 🙂

Best regards
Matthias