Event banner

Microsoft Sentinel Data Tiering Best Practices - Tech Community Live!

Event Ended

Tuesday, Oct 29, 2024, 09:00 AM PDT

Online

Event details

Discover the power of the new Auxiliary logs tier (Public Preview) and learn how to use Summary rules (Public Preview) to summarize data from any log tier in Microsoft Sentinel and Log Analytics. We’...

TrevorRusher

Updated Dec 27, 2024

microsoft sentinel

sylviahuang

Copper Contributor

Oct 29, 2024

Is there a complete list of operators that are permitted or prohibited in Auxiliary logs?

Matt_Lowe
Microsoft
Oct 29, 2024
Please see: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/basic-logs-query?tabs=portal-1#kusto-query-language-kql-language-limitations
Didier-MSFT
Microsoft
Oct 29, 2024
Summary rule for Auxiliary logs: KQL Supports all KQL commands on a single table. You can join up to five Analytics tables using the lookup operator https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/lookup-operator

Date and Time

Oct 29, 20249:00 AM - 10:00 AM PDT