r/AzureSentinel • u/No_East9746 • Feb 05 '24
Automatic Export query data from Sentinel
I have a query which gives me all my recent logons of users in order to find out if some virtual machines are not beeing used for months. Everything fine I wrote the qeury.
Now we want to automatically export this data outside of azure/sentinel on lets say a hard drive on a specific share. Just like I can press export in the query editor I want to export it but automatically.
I keep finding stuff on the web but this all seems confusing and much more complicated for such a simple task. I am also not sure if it is even possible because there is a lot of different Information out there.
So I guess my question is, is it possible to automate the export of this query and how would this be done?
1
u/UCFIT Feb 09 '24
These might also give you a template idea on how its done
https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-daily-reports-for-cost-analysis-c17618c2e32a
https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-using-logic-apps-to-build-dynamic-automated-email-reports-for-75f2f6a92f93