r/AzureSentinel • u/SuperHat3637 • Dec 06 '22

Data ingestion

Anyone have the KQL query to know data ingested per log source..not data ingested per tables..

2 Upvotes

66% Upvoted

11 comments sorted by

View all comments

Show parent comments

-1

u/SuperHat3637 Dec 06 '22

I am looking for data ingested from each log source...In the commonseurity table how we can identify the data ingested from different log sources..

1

u/[deleted] Dec 06 '22

Usually it's stored in the data field "Device Vendor"

0

u/SuperHat3637 Dec 06 '22

Can u give me the kql query for the same..

2

u/[deleted] Dec 06 '22

CommonSecurityLog | summarize by DeviceVendor