Basic Logs, of course, is a preview feature for Microsoft Sentinel that enables customers a cheaper, but more limited way to ingest large volume, low security value logs. If you’ve not heard of this new feature yet, check out the following recent articles to catch up:
- When to Use and When NOT to Use Basic Logs with Microsoft Sentinel
- The Basic Logs for Microsoft Sentinel KQL Limitations
Over Twitter, a great question was raised last week about how to know which tables have been configure for Basic Logs and which ones have not.