Forum Discussion

pvandenbossche's avatar
pvandenbossche
Copper Contributor
Jun 21, 2021

KQL query to see log usage

We have on boarded various logsources through logstash from on premise into sentinel. However we are wondering if there is a possibility to get insights into which logs we are using, and which logs ...
m_zorich's avatar
m_zorich
Iron Contributor
Jul 03, 2021

You can export queries run against a log analytics workspace back into Sentinel (or a different workspace). On your Sentinel workspace If you go Diagnostic Settings -> Add a diagnostic setting -> Send to Log Analytics workspace. They then appear under the LAQuery table. The problem you have is the querytext field that returns is just a straight copy of the query that was run and your staff may construct their queries in a lot of different ways. If you extract everything before | from that querytext field to a new column it may give you some direction, but think that data will need a heap of sanitizing to make it valuable.

 

Edit - a quick way would be to query based on the table name, you will get additional results if a query uses multiple tables, also if you haven't yet turned on the diagnostic setting the data will only fill in once you do

 

LAQueryLogs
| project QueryText
| summarize SecurityAlerts = countif(QueryText contains "SecurityAlert"), SysLogs = countif(QueryText contains "SysLog_CL"), DuoLogs= countif(QueryText contains "DuoLogs_CL"), SigninLogs = countif(QueryText contains "SigninLogs")

 

 

Resources