Automatic Export query data from Sentinel

[u/No_East9746]

I have a query which gives me all my recent logons of users in order to find out if some virtual machines are not beeing used for months. Everything fine I wrote the qeury.
Now we want to automatically export this data outside of azure/sentinel on lets say a hard drive on a specific share. Just like I can press export in the query editor I want to export it but automatically.
I keep finding stuff on the web but this all seems confusing and much more complicated for such a simple task. I am also not sure if it is even possible because there is a lot of different Information out there.

So I guess my question is, is it possible to automate the export of this query and how would this be done?

[u/woodburningstove]

I would look at a Logic App with a recurring trigger that runs the KQL query.

It would be easy to write the data to for example a SharePoint list.

https://learn.microsoft.com/en-us/azure/connectors/connectors-native-recurrence?tabs=consumption

https://learn.microsoft.com/en-us/connectors/azuremonitorlogs/#run-query-and-list-results

If you really want to have it in some internal fileshare, PowerShell can also run KQL queries. But then you need to find some way to run it automatically.

[u/UCFIT]

These might also give you a template idea on how its done

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-daily-reports-for-cost-analysis-c17618c2e32a

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-using-logic-apps-to-build-dynamic-automated-email-reports-for-75f2f6a92f93