SOLVED
Home

How to delete sentinel

%3CLINGO-SUB%20id%3D%22lingo-sub-674894%22%20slang%3D%22en-US%22%3EHow%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-674894%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Team%2C%3C%2FP%3E%3CP%3EI%20have%20created%20one%20sentinel%20and%20connected%20to%20ALA%20in%20LAB.%20Now%20i%20want%20to%20remove%20them.%3C%2FP%3E%3CP%3ESo%20could%20anyone%20help%20me%20how%20to%20delete%20sentinel%20from%20subscription.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20one%20more%20thing%20if%20anyone%20can%20shed%20any%20link%20or%20other%20stuff%20to%20configure%20sentinel%20in%20production.%3C%2FP%3E%3CP%3EI%20have%20gone%20through%20MS%20blogs%20however%20it%20would%20be%20great%20if%20i%20will%20have%20something%20for%20deep-dive.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance!%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-683867%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-683867%22%20slang%3D%22en-US%22%3E%3CP%3EHey%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F184511%22%20target%3D%22_blank%22%3E%40Gourav%20Kumar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20want%20to%20remove%20Sentinel%2C%20you%20can%20just%20delete%20the%20workspace.%26nbsp%3B%20First%2C%20go%20to%20the%20workspace%20settings%20within%20Sentinel%20(attachment%20%231).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThen%20press%20the%20'Delete'%20button%20on%20the%20top%20when%20the%20page%20loads%20(attachment%20%232).%26nbsp%3B%20Note%20that%20this%20will%20delete%20your%20data%20in%20the%20workspace%20and%20all%20other%20configurations.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20want%20to%20just%20delete%20a%20data%20source%20you%20can%20disconnect%20them%20individually%20in%20the%20'Data%20Connectors'%20page.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20hope%20this%20help!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAndrew%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-694646%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20delete%20sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-694646%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F184511%22%20target%3D%22_blank%22%3E%40Gourav%20Kumar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAn%20additional%20procedure%20you%20can%20use%20is%20to%20remove%20the%20sentinel%20solution%20from%20the%20Workspace%20and%26nbsp%3B%20restore%20it%20to%20be%20a%20Log%20Analytics%20workspace.%20Any%20Sentinel%20configuration%20such%20as%20connectors%20and%20alert%20rules%20will%20be%20deleted%2C%20but%20the%20data%20will%20be%20kept%20in%20the%20Workspace%20and%20can%20be%20used%20through%20the%20Log%20Analytics%20workspace.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20do%20that%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ESelect%20%22Workspace%20settings%22%3C%2FLI%3E%0A%3CLI%3ESelect%20%22Solutions%22%3C%2FLI%3E%0A%3CLI%3ESelect%20the%20SecurityInsights%20solutions%3C%2FLI%3E%0A%3CLI%3EUse%20the%20delete%20button%20at%20the%20top%3C%2FLI%3E%0A%3C%2FOL%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Hi Team,

I have created one sentinel and connected to ALA in LAB. Now i want to remove them.

So could anyone help me how to delete sentinel from subscription.

 

And one more thing if anyone can shed any link or other stuff to configure sentinel in production.

I have gone through MS blogs however it would be great if i will have something for deep-dive.

 

Thanks in advance! 

2 Replies
Highlighted

Hey @Gourav Kumar 

 

If you want to remove Sentinel, you can just delete the workspace.  First, go to the workspace settings within Sentinel (attachment #1).

 

Then press the 'Delete' button on the top when the page loads (attachment #2).  Note that this will delete your data in the workspace and all other configurations.

 

If you want to just delete a data source you can disconnect them individually in the 'Data Connectors' page.

 

We hope this help!

 

Andrew

Highlighted
Solution

@Gourav Kumar 

 

An additional procedure you can use is to remove the sentinel solution from the Workspace and  restore it to be a Log Analytics workspace. Any Sentinel configuration such as connectors and alert rules will be deleted, but the data will be kept in the Workspace and can be used through the Log Analytics workspace.

 

To do that:

  1. Select "Workspace settings"
  2. Select "Solutions"
  3. Select the SecurityInsights solutions
  4. Use the delete button at the top