Home

How to delete sentinel

%3CLINGO-SUB%20id%3D%22lingo-sub-674907%22%20slang%3D%22en-US%22%3EHow%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-674907%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Team%2C%3C%2FP%3E%3CP%3EI%20have%20created%20one%20sentinel%20and%20connected%20to%20ALA%20in%20LAB.%20Now%20i%20want%20to%20remove%20them.%3C%2FP%3E%3CP%3ESo%20could%20anyone%20help%20me%20how%20to%20delete%20sentinel%20from%20subscription.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20one%20more%20thing%20if%20anyone%20can%20shed%20any%20link%20or%20other%20stuff%20to%20configure%20sentinel%20in%20production.%3C%2FP%3E%3CP%3EI%20have%20gone%20through%20MS%20blogs%20however%20it%20would%20be%20great%20if%20i%20will%20have%20something%20for%20deep-dive.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance!%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-677262%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-677262%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F184511%22%20target%3D%22_blank%22%3E%40Gourav%20Kumar%3C%2FA%3E%26nbsp%3Byou%20cannot%20delete%20Sentinel%20itself%2C%20but%20you%20can%20delete%20the%20Log%20Analytics%20workspaces%20associated%20with%20it%20to%20accomplish%20pretty%20much%20the%20same%20thing%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-677657%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-677657%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F184511%22%20target%3D%22_blank%22%3E%40Gourav%20Kumar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20should%20probably%20removed%20any%20Data%20Connectors%20you%20added%20in%20Sentinel.%26nbsp%3B%20Also%20I%20assume%20the%20workspace%20was%20created%20for%20especially%20for%20Sentinel%20and%20only%20for%20Sentinel%20to%20use%2C%20if%20not%20deleting%20might%20not%20be%20the%20best%20idea.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-682644%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-682644%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Both%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20valuable%20reply.%3C%2FP%3E%3CP%3EI%20have%20connected%20sentinel%20with%20my%20centralized%20ALA%20that%20are%20monitoring%20and%20collection%20logs%20from%20five%20different%20subscription.%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20deletion%20of%20ALA%20is%20not%20at%20all%20feasible%20here%2C%20I%20guess%20now%20i%20have%20to%20live%20with%20this%20unwanted%20piece.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20would%20be%20great%20if%20MS%20will%20think%20about%20deletion%20option%20of%20ALA%20too.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-907992%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-907992%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F184511%22%20target%3D%22_blank%22%3E%40Gourav%20Kumar%3C%2FA%3E%26nbsp%3B%20I%20don't%20know%20if%20I%20understood%20correctly%20your%20question%2C%20anyway%20Sentinel%20is%20a%20solution%20in%20Log%20Analytics%20terms%2C%20so%20to%20disable%20Sentinal%20for%20that%20workspace%20you%20just%20have%20to%20remove%20the%20Sentinel%20solution%3A%3C%2FP%3E%3COL%3E%3CLI%3ESelect%20%E2%80%9CWorkspace%20settings%E2%80%9D%3C%2FLI%3E%3CLI%3ESelect%20%E2%80%9CSolutions%E2%80%9D%3C%2FLI%3E%3CLI%3ESelect%20the%20SecurityInsights%20solutions%3C%2FLI%3E%3CLI%3EUse%20the%20delete%20button%20at%20the%20top%3C%2FLI%3E%3C%2FOL%3E%3C%2FLINGO-BODY%3E
Gourav Kumar
Contributor

Hi Team,

I have created one sentinel and connected to ALA in LAB. Now i want to remove them.

So could anyone help me how to delete sentinel from subscription.

 

And one more thing if anyone can shed any link or other stuff to configure sentinel in production.

I have gone through MS blogs however it would be great if i will have something for deep-dive.

 

Thanks in advance! 

4 Replies

@Gourav Kumar you cannot delete Sentinel itself, but you can delete the Log Analytics workspaces associated with it to accomplish pretty much the same thing

@Gourav Kumar 

 

You should probably removed any Data Connectors you added in Sentinel.  Also I assume the workspace was created for especially for Sentinel and only for Sentinel to use, if not deleting might not be the best idea.

Hi Both,

 

Thanks for the valuable reply.

I have connected sentinel with my centralized ALA that are monitoring and collection logs from five different subscription. 

So deletion of ALA is not at all feasible here, I guess now i have to live with this unwanted piece.

 

It would be great if MS will think about deletion option of ALA too.

@Gourav Kumar  I don't know if I understood correctly your question, anyway Sentinel is a solution in Log Analytics terms, so to disable Sentinal for that workspace you just have to remove the Sentinel solution:

  1. Select “Workspace settings”
  2. Select “Solutions”
  3. Select the SecurityInsights solutions
  4. Use the delete button at the top
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies