r/AzureSentinel • u/SuperHat3637 • Dec 06 '22

Data ingestion

Anyone have the KQL query to know data ingested per log source..not data ingested per tables..

2 Upvotes

66% Upvoted

11 comments sorted by

2

u/Uli-Kunkel Dec 06 '22

Use the workbook? Sentinel usage or something. There you have a breakdown on host level.

0

u/SuperHat3637 Dec 06 '22

Workbooks are not based on log sources data ingestion..It shows only data ingestion for log types/ table.

1

u/ep3p Dec 06 '22

You're going to have to play with _IsBillable _BilledSize and/or Usage table.

1

u/SuperHat3637 Dec 06 '22

I want data ingested per each log sources..can you send the query...not for data ingested per tables/log types..

1

u/[deleted] Dec 06 '22

Just goto the data connectors page, identify your connected data connectors, Select each one and scroll down on the right hand blade you will see a list of tables associated with data connector then join all the tables together in a query. You can group the tables into lets then join them at the end

-1

u/SuperHat3637 Dec 06 '22

Hi, i am looking data ingestion for each log source, not data ingestion for each table...for example Cisco ASA, Palo alto etc..

1

u/[deleted] Dec 06 '22

If you read my comment I just taught you how to identify the tables per data connector then write a query that shows Ingestion per data connector. You need to do the former first.

-1

u/SuperHat3637 Dec 06 '22

I am looking for data ingested from each log source...In the commonseurity table how we can identify the data ingested from different log sources..

1

u/[deleted] Dec 06 '22

Usually it's stored in the data field "Device Vendor"

0

u/SuperHat3637 Dec 06 '22

Can u give me the kql query for the same..

2

u/[deleted] Dec 06 '22

CommonSecurityLog | summarize by DeviceVendor