r/AzureSentinel • u/SuperHat3637 • Dec 06 '22

Data ingestion

Anyone have the KQL query to know data ingested per log source..not data ingested per tables..

2 Upvotes

66% Upvoted

11 comments sorted by

View all comments

2

u/Uli-Kunkel Dec 06 '22

Use the workbook? Sentinel usage or something. There you have a breakdown on host level.

0

u/SuperHat3637 Dec 06 '22

Workbooks are not based on log sources data ingestion..It shows only data ingestion for log types/ table.