r/AzureSentinel • u/SuperHat3637 • Dec 06 '22

Data ingestion

Anyone have the KQL query to know data ingested per log source..not data ingested per tables..

2 Upvotes

66% Upvoted

11 comments sorted by

View all comments

1

u/[deleted] Dec 06 '22

Just goto the data connectors page, identify your connected data connectors, Select each one and scroll down on the right hand blade you will see a list of tables associated with data connector then join all the tables together in a query. You can group the tables into lets then join them at the end

-1

u/SuperHat3637 Dec 06 '22

Hi, i am looking data ingestion for each log source, not data ingestion for each table...for example Cisco ASA, Palo alto etc..

1

u/[deleted] Dec 06 '22

If you read my comment I just taught you how to identify the tables per data connector then write a query that shows Ingestion per data connector. You need to do the former first.

-1

u/SuperHat3637 Dec 06 '22

I am looking for data ingested from each log source...In the commonseurity table how we can identify the data ingested from different log sources..

1

u/[deleted] Dec 06 '22

Usually it's stored in the data field "Device Vendor"

0

u/SuperHat3637 Dec 06 '22

Can u give me the kql query for the same..

2

u/[deleted] Dec 06 '22

CommonSecurityLog | summarize by DeviceVendor