Send to Sentinel logs from many Log Analytics

[Artem_Rozhko]

Hello dear colleagues, we have several Log Analytics workspaces (13) and one Azure sentinel. Is it possible to send logs from our 13 Log Analytics Workspaces to one Azure Sentinel workspace? Is it possible?

[#2 · Accepted solution]

@Artem_Rozhko An Azure Sentinel instance can only work against 1 Log Analytics workspace.  You have a few options here.  1) Have all the resources send their logs to a single Log Analytics workspace and have Azure Sentinel use that. (probably the best solution if feasible) 2) Use something like an Event Hub and have the other 12 workspaces send their data into the 1 that Azure Sentinel uses (not recommended)  3) Create an Azure Sentinel instance for each Log Analytic workspace and then use Azure Lighthouse to provide an overall picture of all the incidents that occur.  Basically treating your environment like a MSSP (2nd best option but easiest to implement).    Just remember that if you do associate a Log Analytics workspace with Azure Sentinel there is an additional ingestion cost added.

[#3]

Wow, thanks Gary for this ultimate answer! I suppose we will use first one option.

[#4]

If you want to learn more from him, you should get his book https://www.amazon.com/Learn-Azure-Sentinel-artificial-intelligence/dp/183898092X

[#5]

@Gary Bushey this is very helpful, thank you. However, I'm interested in knowing why option 2 is not recommended, what are the drawbacks for this approach?

[#6]

@Hairy_Zeus  The main reason is cost.  You are needlessly duplicating data and you will need to pay the ingestion charges for both workspaces and this includes any of the free data (like O365 logs and Azure audit logs).   It will not be free when being sent to the second workspace