Forum Discussion

securemetrics's avatar
securemetrics
Copper Contributor
Aug 02, 2025

Sentinel Datalake - How to query outside of defender portal?

I've been doing some testing on Sentinel Datalake but I'm running into a major gap.  How do we query the datalake outside Jupyter notebooks or the defender portal?  Currently, this is done by con...
analytics
integration
SumanthSomireddy's avatar
SumanthSomireddy
Icon for Microsoft rankMicrosoft
Aug 05, 2025

Hi securemetrics​ 

Microsoft Sentinel's Data Lake is a newer component, and the current access approaches are restricted to: Microsoft Defender Portal, Microsoft Sentinel Notebooks and Microsoft Fabric Lakehouse Explorer.  Querying Sentinel Data Lake from outside these environments is not fully supported. The possible ways are:

Jupyter Notebooks in Sentinel

Uses Python SDK to access the Fabric Lakehouse

Defender Portal > Query View

Allows KQL querying inside the browser

Microsoft Fabric Integration

Power BI, Notebooks, Data Flows can be used if Sentinel Workspace is linked to Fabric Workspace

  • securemetrics's avatar
    securemetrics
    Copper Contributor
    Aug 05, 2025

    Fabric integration would be phenomenal. I cannot find any documentation on this, however. 

Resources