Log analytics API

Frequent Contributor

Hey - i have built up a collection of saved searches in Azure log analytics, mainly searching the SecurityAlerts, SignInLogs and OfficeActivity tables.  When i get a security alert notification from Microsoft, I run my searches then export to CSV to search for indicators of compromise bla bla.  This is great, somewhat quick and easy..


But is there a programmatic way of doing this?


Using the Security Graph API i can see the signIn resource type, so thats great, but i do not see exchange mailbox audit log resource, so i cannot see how to retrieve audit logs via an API..


Can i query the Log Analytics data directly through an API or is there another way to access this data programatically?


I looked at using the Azure Cloud Console, but even this didn't seem to be able to access the data..


1 Reply
best response confirmed by AndrewX (Frequent Contributor)



There is the Log Analytocs API  and  the


When you get a Security Alert you could call a playbook (Logic App) to work with that data, even if its only to create that CSV file.


Azure Sentinel has a new connector to O365 (not look too closely myself at this particular connector and data, but Exchange is mentioned).