Sentinel connectors using functions

Question

Hi all, within functions that are used as connectors for Sentinel, I see lines of code like 'write-host "Successfully did such and such"... where can I see this output from the code? I'm expecting something similar to the output from a PowerShell Runbook, but am scratching my head trying to find it.

It is probably right under my nose somewhere...

Thanks,
Simon

Answer 1

Hi @Simon Burbery ,

Thanks for reaching out to Q&A.

The logs (write-host "Successfully did such and such) that you see in the function console is the function execution logs. You can view them in the log stream or in the Monitor section, any logging statement that is present in the powershell script would be visible in the logstream and monitor section that has the function invocation logs.

Clicking on the below invocation would provide more logs

However if you are looking to view the logs that are ingested to the sentinel from the data source via function data connector, then you will have to look into the CustomLogs table under logs in the log analytics workspace linked with the Microsoft sentinel.

https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-functions-template?tabs=ARM#find-your-data

Hope this helps! Feel free to reach out to me if you have any queries.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.