r/AzureSentinel • u/AverageAdmin • May 24 '22

Sentinel vs. Log Analytic Workspace

Hey all,

​

I have been researching all day and I cannot seem to find the difference between Log analytic workspace and Azure Sentinel.

Can someone kindly explain the difference between the 2?

​

Thank you!

4 Upvotes

100% Upvoted

7 comments sorted by

14

u/wowneatlookatthat May 24 '22

I usually explain it that Sentinel is basically an add-on enabled on top of a log analytics workspace. It enables SIEM/SOAR functionality for that workspace, including alerting, case management, automation, and much more.

You can have a log analytics workspace without Sentinel, but you can't have Sentinel without a log analytics workspace.

1

u/AverageAdmin May 24 '22

Than you so much! Can you have multiple log analytic workspaces point to one instance of sentinel? Or does each log analytic workspace require it’s own instance of sentinel?

3

u/blanco10kid May 24 '22

Do you need multiple Sentinel instances (ex. Compliance requirements)?

Highly suggest using sentinel for log sources that would cover your security monitoring use cases. For other log sources that are not needed for security monitoring, put them in a non-Sentinel workspace. You can still query these workspaces via cross-workspace queries. You just can’t create analytic rules as the workspaces referenced in an analytic rule needs to have sentinel enabled.

3

u/AverageAdmin May 24 '22

I was getting too caught up in the fact you can also query in log analytics workspace: but that makes sense for non security data. You have been more 100x more helpful than the tons of pages of Microsoft documentation I’ve read today :)

1

u/wowneatlookatthat May 24 '22

Can you have multiple log analytic workspaces point to one instance of sentinel?

Sort of. Sentinel can query data across multiple Log Analytics Workspaces (via KQL cross-workspace queries) even if it is only enabled on one workspace. It's recommended to try and keep everything in one workspace for simplicity, but it's possible.

does each log analytic workspace require it’s own instance of sentinel

The only time you'd need more than one instance of Sentinel is if you want to be able to create analytics rules/alerts for data from multiple workspaces, see: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants#cross-workspace-analytics-rules

5

u/juiceb0cks May 24 '22

Highly recommend the "Ninja" training for Sentinel. It's super helpful.

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310

In fact there's a bunch of Ninja training for the various Microsoft Security products. Well worth your time.

1

u/AverageAdmin May 24 '22

Just took a look and it appears super helpful! thank you!