Forum Discussion
Solved
Extend sentinel/LAW table schema
Hi, we are working on migrating from a SIEM solution to sentinel and for users to migrate easily, we want to have some custom fields to LAW/Sentinel tables (eg) a filed named brand_CF needs to be add...
Thanks, I was able to get it working with API.. on Terraform I used and tested the AZAPI and created the _CL tables and _CF fields successfully.
https://learn.microsoft.com/en-us/rest/api/loganalytics/tables/create-or-update?view=rest-loganalytics-2025-02-01&tabs=HTTP
This is a useful approach for keeping the LAW table schema consistent and easier to maintain. I like the focus on extending the structure without making the existing setup harder to manage. I also find resources like https://tazewellcountycourt.org helpful when reviewing how legal information can be organized. The schema changes should make future updates and queries much easier to handle.