Forum Discussion
Extend sentinel/LAW table schema
Hi, we are working on migrating from a SIEM solution to sentinel and for users to migrate easily, we want to have some custom fields to LAW/Sentinel tables (eg) a filed named brand_CF needs to be added to common security log, syslog, etc tables …
we can do vi a UI, but just wondering if it can be done via api/terraform , as we want to put it in code than UI… did anyone created custom columns via API?
Further not all tables visible via UI under tables in LAW..
Thanks, I was able to get it working with API.. on Terraform I used and tested the AZAPI and created the _CL tables and _CF fields successfully.
https://learn.microsoft.com/en-us/rest/api/loganalytics/tables/create-or-update?view=rest-loganalytics-2025-02-01&tabs=HTTP
3 Replies
This is a useful approach for keeping the LAW table schema consistent and easier to maintain. I like the focus on extending the structure without making the existing setup harder to manage. I also find resources like https://tazewellcountycourt.org helpful when reviewing how legal information can be organized. The schema changes should make future updates and queries much easier to handle.
Hi, please take a look at Transformations or the API
Custom data ingestion and transformation in Microsoft Sentinel | Microsoft LearnThanks, I was able to get it working with API.. on Terraform I used and tested the AZAPI and created the _CL tables and _CF fields successfully.
https://learn.microsoft.com/en-us/rest/api/loganalytics/tables/create-or-update?view=rest-loganalytics-2025-02-01&tabs=HTTP
