SOLVED
Home

How to delete sentinel

%3CLINGO-SUB%20id%3D%22lingo-sub-674894%22%20slang%3D%22en-US%22%3EHow%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-674894%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Team%2C%3C%2FP%3E%3CP%3EI%20have%20created%20one%20sentinel%20and%20connected%20to%20ALA%20in%20LAB.%20Now%20i%20want%20to%20remove%20them.%3C%2FP%3E%3CP%3ESo%20could%20anyone%20help%20me%20how%20to%20delete%20sentinel%20from%20subscription.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20one%20more%20thing%20if%20anyone%20can%20shed%20any%20link%20or%20other%20stuff%20to%20configure%20sentinel%20in%20production.%3C%2FP%3E%3CP%3EI%20have%20gone%20through%20MS%20blogs%20however%20it%20would%20be%20great%20if%20i%20will%20have%20something%20for%20deep-dive.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance!%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-683867%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-683867%22%20slang%3D%22en-US%22%3E%3CP%3EHey%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F184511%22%20target%3D%22_blank%22%3E%40Gourav%20Kumar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20want%20to%20remove%20Sentinel%2C%20you%20can%20just%20delete%20the%20workspace.%26nbsp%3B%20First%2C%20go%20to%20the%20workspace%20settings%20within%20Sentinel%20(attachment%20%231).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThen%20press%20the%20'Delete'%20button%20on%20the%20top%20when%20the%20page%20loads%20(attachment%20%232).%26nbsp%3B%20Note%20that%20this%20will%20delete%20your%20data%20in%20the%20workspace%20and%20all%20other%20configurations.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20want%20to%20just%20delete%20a%20data%20source%20you%20can%20disconnect%20them%20individually%20in%20the%20'Data%20Connectors'%20page.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20hope%20this%20help!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAndrew%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-694646%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-694646%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F184511%22%20target%3D%22_blank%22%3E%40Gourav%20Kumar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAn%20additional%20procedure%20you%20can%20use%20is%20to%20remove%20the%20sentinel%20solution%20from%20the%20Workspace%20and%26nbsp%3B%20restore%20it%20to%20be%20a%20Log%20Analytics%20workspace.%20Any%20Sentinel%20configuration%20such%20as%20connectors%20and%20alert%20rules%20will%20be%20deleted%2C%20but%20the%20data%20will%20be%20kept%20in%20the%20Workspace%20and%20can%20be%20used%20through%20the%20Log%20Analytics%20workspace.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20do%20that%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ESelect%20%22Workspace%20settings%22%3C%2FLI%3E%0A%3CLI%3ESelect%20%22Solutions%22%3C%2FLI%3E%0A%3CLI%3ESelect%20the%20SecurityInsights%20solutions%3C%2FLI%3E%0A%3CLI%3EUse%20the%20delete%20button%20at%20the%20top%3C%2FLI%3E%0A%3C%2FOL%3E%3C%2FLINGO-BODY%3E
Gourav Kumar
Contributor

Hi Team,

I have created one sentinel and connected to ALA in LAB. Now i want to remove them.

So could anyone help me how to delete sentinel from subscription.

 

And one more thing if anyone can shed any link or other stuff to configure sentinel in production.

I have gone through MS blogs however it would be great if i will have something for deep-dive.

 

Thanks in advance! 

2 Replies

Hey @Gourav Kumar 

 

If you want to remove Sentinel, you can just delete the workspace.  First, go to the workspace settings within Sentinel (attachment #1).

 

Then press the 'Delete' button on the top when the page loads (attachment #2).  Note that this will delete your data in the workspace and all other configurations.

 

If you want to just delete a data source you can disconnect them individually in the 'Data Connectors' page.

 

We hope this help!

 

Andrew

Solution

@Gourav Kumar 

 

An additional procedure you can use is to remove the sentinel solution from the Workspace and  restore it to be a Log Analytics workspace. Any Sentinel configuration such as connectors and alert rules will be deleted, but the data will be kept in the Workspace and can be used through the Log Analytics workspace.

 

To do that:

  1. Select "Workspace settings"
  2. Select "Solutions"
  3. Select the SecurityInsights solutions
  4. Use the delete button at the top
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies