Forum Discussion

ScottJensen_KS's avatar
ScottJensen_KS
Copper Contributor
Aug 15, 2022

list all log sources

So I'm just getting started with Microsoft Sentinel, and am looking for a way to produce a single report "listing all log sources".   I'm looking for something like: TableName, SourceType, Compute...
kusto
ScottJensen_KS's avatar
ScottJensen_KS
Copper Contributor
Aug 18, 2022

While https://github.com/rod-trent/SentinelKQL/blob/master/WorkspacesAndTables.txt does a great job of listing active tables and workspaces, I'm looking for more of a report of what devices are currently sending logs.

 

We have several Data Connectors and we are looking for a way to list what is reporting in  for each connector.

 

Example:

We have "Fortinet", "Security Events via Legacy Agent", "Syslog", and "Windows Security Events via AMA"

We would like a report with:

  • Device Reporting(hostname)
  • Platform(OS)
  • DeviceType (OPTIONAL)
    • Virtual
    • Desktop
    • Laptop
  • Type of events
    • Windows System
    • Windows Application
    • Linux Audit
    • etc

 

We are implementing ASIM (https://docs.microsoft.com/en-us/azure/sentinel/normalization-about-parsers), to help with the different parsers, but so far have not found an ASIM function that can output such a list.

  • Rod_Trent's avatar
    Rod_Trent
    Icon for Microsoft rankMicrosoft
    Aug 18, 2022

    ScottJensen_KS Have you looked at the Workspace Usage Report workbook? 

     

    Down at the bottom of the Workspace Info tab, it shows the tables, the resource supplying the data, and the volume per resource...

     

Resources