Are there tables in the Log Analytics workspace hidden from Azure Sentinel?

%3CLINGO-SUB%20id%3D%22lingo-sub-1601334%22%20slang%3D%22en-US%22%3EAre%20there%20tables%20in%20the%20Log%20Analytics%20workspace%20hidden%20from%20Azure%20Sentinel%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1601334%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20noticed%20that%20I%20have%20some%20Application%20Insights%20tables%20in%20my%20Log%20Analytics%20workspace%2C%20like%20perofrmanceCounters%20and%20browserTimings%2C%20but%20I%20cannot%20see%20them%20in%20Azure%20Sentinel.%26nbsp%3B%20%26nbsp%3BIs%20this%20by%20design%20or%20am%20I%20missing%20something%3F%26nbsp%3B%20Granted%20I%20can%20query%20them%20in%20the%20Monitor%20itself%20but%20would%20like%20to%20have%20just%20the%20one%20place%20for%20my%20queries.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1601699%22%20slang%3D%22en-US%22%3ERe%3A%20Are%20there%20tables%20in%20the%20Log%20Analytics%20workspace%20hidden%20from%20Azure%20Sentinel%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1601699%22%20slang%3D%22en-US%22%3EI%20wonder%20if%20they%20were%20renamed%20or%20consolidated%20at%20some%20point.%20I%20know%20for%20our%20instance%2C%20our%20performance%20counters%20show%20up%20under%20the%20Perf%20table%20in%20Sentinel.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1601961%22%20slang%3D%22en-US%22%3ERe%3A%20Are%20there%20tables%20in%20the%20Log%20Analytics%20workspace%20hidden%20from%20Azure%20Sentinel%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1601961%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F572555%22%20target%3D%22_blank%22%3E%40mperrotta%3C%2FA%3E%26nbsp%3BI%20guess%20I%20was%20just%20a%20bit%20impatient.%20I%20am%20seeing%20a%20bunch%20of%20tables%20that%20start%20with%20%22App%22%20that%20seem%20to%20mimic%20what%20I%20see%20in%20Monitor.%26nbsp%3B%20I%20am%20seeing%20the%20table%20names%20but%20no%20data%20yet%20so%20it%20probably%20takes%20a%20while%20for%20it%20to%20show%20up.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20also%20configured%20my%20App%20Service%20to%20send%20data%20to%20Azure%20Sentinel%20as%20well.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1603770%22%20slang%3D%22en-US%22%3ERE%3A%20Are%20there%20tables%20in%20the%20Log%20Analytics%20workspace%20hidden%20from%20Azure%20Sentinel%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1603770%22%20slang%3D%22en-US%22%3EI%20can%20see%20the%20tables%2C%20now%20I%20just%20need%20the%20data%20to%20show%20up.%20Very%20strange%20that%20it%20isn't.%3C%2FLINGO-BODY%3E
Valued Contributor

I've noticed that I have some Application Insights tables in my Log Analytics workspace, like perofrmanceCounters and browserTimings, but I cannot see them in Azure Sentinel.   Is this by design or am I missing something?  Granted I can query them in the Monitor itself but would like to have just the one place for my queries.

3 Replies
I wonder if they were renamed or consolidated at some point. I know for our instance, our performance counters show up under the Perf table in Sentinel.

@mperrotta I guess I was just a bit impatient. I am seeing a bunch of tables that start with "App" that seem to mimic what I see in Monitor.  I am seeing the table names but no data yet so it probably takes a while for it to show up.

 

I also configured my App Service to send data to Azure Sentinel as well.

 

I can see the tables, now I just need the data to show up. Very strange that it isn't.