Home

Importing Legacy Data

%3CLINGO-SUB%20id%3D%22lingo-sub-363136%22%20slang%3D%22en-US%22%3EImporting%20Legacy%20Data%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-363136%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20I've%20got%20a%20bunch%20of%20connectors%20added%20and%20it's%20pulling%20data%2C%20but%20I%20know%20O365%20and%20Azure%20for%20example%20have%20like%2090%20days%20of%20legacy%20data%20in%20there%2C%20is%20there%20a%20way%20to%20tell%20Sentinel%20to%20pull%20in%20all%20that%20data%20for%20events%20that%20have%20already%20occurred%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-363994%22%20slang%3D%22en-US%22%3ERe%3A%20Importing%20Legacy%20Data%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-363994%22%20slang%3D%22en-US%22%3E%3CP%3EAh%20okay%2C%20thanks.%20Please%20do%20consider%20it%2C%20that%20would%20be%20super%20helpful.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-363823%22%20slang%3D%22en-US%22%3ERe%3A%20Importing%20Legacy%20Data%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-363823%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Keith%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAt%20the%20moment%20the%20collectors%20will%20collect%20the%20data%20generated%20after%20they%20were%20enabled.%3C%2FP%3E%0A%3CP%3EWe%20will%20consider%20adding%20support%20for%20history%20data%20later%20on.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%3C%2FP%3E%0A%3CP%3EKoby%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi, I've got a bunch of connectors added and it's pulling data, but I know O365 and Azure for example have like 90 days of legacy data in there, is there a way to tell Sentinel to pull in all that data for events that have already occurred?

2 Replies
Highlighted

Hi Keith,

 

At the moment the collectors will collect the data generated after they were enabled.

We will consider adding support for history data later on.

 

Thanks,

Koby

Highlighted

Ah okay, thanks. Please do consider it, that would be super helpful.