Azure Security Centre and Sentinel sharing LAW

%3CLINGO-SUB%20id%3D%22lingo-sub-2319829%22%20slang%3D%22en-US%22%3EAzure%20Security%20Centre%20and%20Sentinel%20sharing%20LAW%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2319829%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20question%20and%20am%20hoping%20someone%20can%20clarify%20something%20for%20me.%20We%20are%20working%20on%20a%20project%20deploying%20Azure%20Security%20Centre%20and%20Azure%20Defender%20(leveraging%20Qualys%20scanning%20engine)%20for%20vulnerability%20scanning%20capability%2C%20and%20consolidate%20the%20logs%20and%20metrics%20to%20a%20centralised%20Log%20Analytics%20Workspace.%20We%20also%20have%20a%20Sentinel%20project%20using%20its%20own%20Log%20Analytics%20Workspace.%20Am%20i%20correct%20in%20saying%20that%20when%20we%20deploy%20the%20LAW%20agents%20and%20Qualys%20agent%20it%20should%20be%20pointing%20to%20the%20same%20central%20log%20analytics%20that%20Sentinel%20uses%3F%20Or%20should%20it%20be%20using%20another%20Log%20Analytics%20Workspace%20and%20then%20use%20the%20connector%20to%20Sentinel%3F%26nbsp%3BThe%20Sentinel%20Project%20is%20looking%20for%20clarification%20why%20we%20should%20be%20using%20the%20Sentinel%20LAW%20instead%20of%20our%20own.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2320659%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Security%20Centre%20and%20Sentinel%20sharing%20LAW%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2320659%22%20slang%3D%22en-US%22%3ETechnically%20you%20can%20have%20a%20LAW%20for%20ASC%20and%20one%20for%20Azure%20Sentinel%20(and%20use%20the%20connector)%2C%20but%20most%20people%20combine%20the%20two%20workspaces%20into%20one%20shared%20resource.%20Advise%20is%20to%20have%20as%20few%20large%20workspaces%20as%20possible%20(start%20at%20one%2C%20and%20only%20add%20others%20as%20exceptions).%20Also%20remember%20Azure%20Sentinel%20cant%20use%20a%20%22default-%22%20workspace%2C%20that%20ASC%20can%20setup%2C%20so%20you%20need%20a%20named%20LAW.%20The%20data%20not%20to%20have%20in%20Azure%20Sentinel%20is%20operational%20data%20(data%20with%20low%20or%20no%20security%20value)%20especially%20Perf%20data%2C%20Perf%20if%20mid-high%20volume%20probably%20should%20be%20in%20its%20own%20LAW.%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fbecome-an-azure-sentinel-ninja-the-complete-level-400-training%2Fba-p%2F1246310%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fbecome-an-azure-sentinel-ninja-the-complete-level-400-training%2Fba-p%2F1246310%3C%2FA%3E%3C%2FLINGO-BODY%3E
Visitor

I have a question and am hoping someone can clarify something for me. We are working on a project deploying Azure Security Centre and Azure Defender (leveraging Qualys scanning engine) for vulnerability scanning capability, and consolidate the logs and metrics to a centralised Log Analytics Workspace. We also have a Sentinel project using its own Log Analytics Workspace. Am i correct in saying that when we deploy the LAW agents and Qualys agent it should be pointing to the same central log analytics that Sentinel uses? Or should it be using another Log Analytics Workspace and then use the connector to Sentinel? The Sentinel Project is looking for clarification why we should be using the Sentinel LAW instead of our own.

1 Reply
Technically you can have a LAW for ASC and one for Azure Sentinel (and use the connector), but most people combine the two workspaces into one shared resource. Advise is to have as few large workspaces as possible (start at one, and only add others as exceptions). Also remember Azure Sentinel cant use a "default-" workspace, that ASC can setup, so you need a named LAW. The data not to have in Azure Sentinel is operational data (data with low or no security value) especially Perf data, Perf if mid-high volume probably should be in its own LAW. https://techcommunity.microsoft.com/t5/azure-sentinel/become-an-azure-sentinel-ninja-the-complete-le...