Have you looked here, there are some simple examples? https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/azure-monitor/logs/monitor-workspace.md
Sentinel _LogOperation Alerts and Workbooks
Does anyone has a meaningful alert or workbook related to Sentinel _LogOperation table? Looking at the table content, there is lots of noise.
4 answers
Sort by: Most helpful
-
-
Clive Watson 7,006 Reputation points MVP
2022-07-06T13:35:03.907+00:00 I only tend to use this for is ad-hoc looking, rather than an Alert - then dive in if I see an error or a lot of warnings of a type
_LogOperation
| where TimeGenerated > ago(30d)
| where Level in ('Warning','Error')
| summarize count() by Level, Detail, bin(TimeGenerated,1d)
| render columnchart -
Clive Watson 7,006 Reputation points MVP
2022-07-06T13:38:08.407+00:00 If you use my "Workspace Usage" workbook in Sentinel - turn "Show Help" to yes
Then scroll down to the Troubleshooting section - those are the queries from the Github article
-
Jan Stodola 56 Reputation points
2022-07-06T12:07:16.417+00:00 Hi Clive, thank you for your response.
Yes, I am aware of the above article. What I am interested in are the warnings or errors that are serious and actionable from Sentinel user side. (We do not have ingestion limits in our solutions).