Try running these KQL queries
SecureScores
| where TimeGenerated > ago(30d)
| summarize count() by IsSnapshot
SecurityRecommendation
| where TimeGenerated > ago(30d)
| summarize count() by IsSnapshot
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi,
I have setup a continues export for Defender for Cloud as described in the following documentation to export all possible data to a Log Analytics workspace using streaming updates and snapshot. https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export?tabs=azure-portal
The streaming updates seems to work because there is a bit of data in the Log Analytics workspace about changes from the past week. But the snapshot doesn't seem to be working because it has been 8 days and there is no data of the things the I would expect to be in the export. Like the data of the things that haven't changed in the past 8 days since configuring the export. I have also checked that my time range of my queries in the Log Analytics workspace where not limited by 12 hours
Try running these KQL queries
SecureScores
| where TimeGenerated > ago(30d)
| summarize count() by IsSnapshot
SecurityRecommendation
| where TimeGenerated > ago(30d)
| summarize count() by IsSnapshot