Forum Discussion

Arjan Veen, van's avatar
Arjan Veen, van
Brass Contributor
Jun 30, 2022
Solved

Log Analytics design - Defender for Cloud and Sentinel

All,   When you have Defender for Cloud and Sentinel.....do you still use 2 log analytics workspaces or do you reconfigure the defender for cloud log analytics workspace to ingest the defender for ...
  • Chandrasekhar_Arya's avatar
    Chandrasekhar_Arya
    Sep 26, 2022

    Arjan Veen, van one log analytics is good enough to you can forward the ASC(Azure security center/Defender alerts to  Sentinel . 

    Refer the below picture reference to one of the Microsoft source where it shows one log analytics is good enough for both Azure and On-prem 

     

Clive_Watson's avatar
Clive_Watson
Bronze Contributor
Jun 30, 2022
They can happily share a workspace. There are lots of options, but typically I see one workspace.
  • ellyse's avatar
    ellyse
    Icon for Microsoft rankMicrosoft
    Sep 26, 2022
    Hi Clive, do you know if there's any guidance or steps on how this can be set up?
    • Arjan Veen, van's avatar
      Arjan Veen, van
      Brass Contributor
      Sep 27, 2022
      Hello,

      browse to defender for cloud - Environment settings - Auto provisioning - Extensions -Log Analytics agent/Azure Monitor agent - Edit Auto-provisioning configuration - Workspace selection and select the Sentinel workspace
      • ellyse's avatar
        ellyse
        Icon for Microsoft rankMicrosoft
        Sep 27, 2022
        Hi - I'm not seeing any mention of "Auto - provisioning ..." etc in the MDC environment settings. Could it be somewhere else?