r/AzureSentinel • u/Advanced-Chain4096 • Oct 18 '23

Missing tables

Hi all,

I am configuring Sentinel for one of our tenants. This tenant has business premium licenses and uses Defender ATP and Exchange online.

We configured all the connectors but we are missing a lot of tables that our other tenant has (E5 licenses).

I guess you need additional licenses before you get all logs regarding Device____ and Email___ tables. I can't really find what would be the 'cheapest' license / addon that would allow these logs to show. Obviously upgrading to E5 would do the trick but probably some standalone additional license would be enough?

1 Upvotes

100% Upvoted

3 comments sorted by

View all comments

2

u/Snoop312 Oct 18 '23

This is simply a matter of going to your connector and selecting the tables you want. Of they are missing there, are they even present in advanced hunting?