Can we find Azure portal notifications in logs

Highlighted
Occasional Contributor
I need to fetch the Azure portal notifications from logs. Is there a way to do it in Azure Sentinel.?
5 Replies
Highlighted

@uditk14 

 

Do you mean, from the Portal blade 'bell' icon?  I'm pretty sure they are not stored in Logs.

 

Annotation 2020-06-19 102152.jpg

Highlighted

@Clive Watson - Yes, I want the bell icon notifications. I am able to fetch similar details in the Azure Activity but I wanted to know if something exists directly for this.

 

Highlighted

@uditk14 

 

AzureActivity is a source you can store in a Log Analytics workspace, Azure Sentinel uses Log Analytics - so you can see the data from the portal, Log Analytics or Azure Sentinel - providing you have the data in a workspace.   For my reference what Query are you using the see the Notifications data?

Highlighted

@Clive Watson: I think @uditk14 wants to know what the query needed, i.e. what are the events to look for in AzureActivity. 

Highlighted

@Ofer_Shezaf @Clive Watson - Portal notifications seem to be a subset of Azure Activity. Usually, we get a notification on success, failure of activities. Some filtering needs to applied fetching the notifications from it. trying to find out that