Deploy Azure Sentinel solution

Question

Hello,

At this moment I have single tenant with 2 separated subscriptions.

In one subscription I have deployed VAST solution with log analytics workspace.

I want to deploy Azure sentinel instead. Could I create new log analytics workspace and connect it to Azure Sentinel, so the VAST solution keeps working with my second log analytics workspace?

So for example my IIS server has MMA agent and now it's sends log to VAST log analytics workspace, I will edit MMA settings and add Azure Sentinel Workspace. So the IIS server would send logs to two separated log analytics workspace. Should it work?

Answer 1

Yes, the Windows MMA agent can report to multiple Log Analytics workspaces : https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agent-manage#adding-or-removing-a-workspace