Forum Discussion
Deepanshu_Marwah
Jan 11, 2023Brass Contributor
Are there any steps to perform API based ingestion to built in tables in sentinel?
Hi All
Based on new log ingestion API documentation:
The Logs Ingestion API can send data to the following built-in tables. Other tables may be added to this list as support for them is implemented. Following built in tables are supported:
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/commonsecuritylog
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/syslog
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/windowsevent
Ref: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview#supported-tables
URI: {Data Collection Endpoint URI}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2021-11-01-preview
I don't see any documentation or guidance to ingest data to standard tables via API. If someone has performed this, please share the steps.
No RepliesBe the first to reply