Forum Discussion
Microsoft Sentinel - switching simple mode to kql mode in sentinel logs
In sentinel, when i go to the alert page and from there i opened the corresponding the events using Link to LA clickable link, it opens the events in simple mode. However i have configured the Logs to open it in KQL mode and every time i have to changed it to KQL mode to do the task
1 Reply
Your screenshots show KQL already selected as the default, while the alert’s Link to LA opens its results in Simple mode. Microsoft documents that default under Log Analytics settings, so repeating the same configuration is not a demonstrated fix. First compare opening Logs directly on the same workspace with opening that specific alert link, using the same signed-in browser session. This distinguishes a preference that is not being retained from behavior specific to the alert navigation. For the immediate investigation, switch the opened results to KQL mode using the top-right dropdown; Microsoft documents that the corresponding query is preserved in the editor for further editing. If only the alert link ignores your preference, report that reproducible path to Azure support with the workspace context, browser version, alert example, and screenshots. I cannot confirm a documented setting that forces every Sentinel alert link to honor the default.
