Sentinel workspace

Question

Hello,If all the Virtual machines are connected to a Sentinel workspace and at the same time I have enabled Defender for Cloud for Virtual Machines, will this make the mma agent in the VMs report to two workspaces and store logs on both Sentinel workspace and Defender for cloud workspace?Thanks in Adv.

gbushey · Answer

That is correct.  You will need to decide how much of that extra data is being ingested compared to the value of other data being available to Sentinel

rod_trent · Answer

You should have Defender for Cloud and Microsoft Sentinel sharing the same workspace.

pramodkm · Answer

Thanks Rod_Trent, but from a cost perspective Sentinel pricing will be applicable to all the logs that are ingested from Defender for cloud some of which might not have any security value right?

sergiot1228 · Answer

Hello Rod_Trent, just to clarify. We should set our continuous export log analytics workspace as the same workspace set for Sentinel?Cheers

Forum Discussion

Sentinel workspace