Share via

Sentinel _LogOperation Alerts and Workbooks

Jan Stodola 26 Reputation points
2022-07-05T16:18:49.693+00:00

Does anyone has a meaningful alert or workbook related to Sentinel _LogOperation table? Looking at the table content, there is lots of noise.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 5,721 Reputation points MVP
    2022-07-06T08:11:59.357+00:00
    1 person found this answer helpful.
    0 comments
  2. Clive Watson 5,721 Reputation points MVP
    2022-07-06T13:35:03.907+00:00

    I only tend to use this for is ad-hoc looking, rather than an Alert - then dive in if I see an error or a lot of warnings of a type

    _LogOperation
    | where TimeGenerated > ago(30d)
    | where Level in ('Warning','Error')
    | summarize count() by Level, Detail, bin(TimeGenerated,1d)
    | render columnchart

    218221-image.png

    1 person found this answer helpful.
    0 comments
  3. Clive Watson 5,721 Reputation points MVP
    2022-07-06T13:38:08.407+00:00

    If you use my "Workspace Usage" workbook in Sentinel - turn "Show Help" to yes

    218203-image.png

    Then scroll down to the Troubleshooting section - those are the queries from the Github article

    218204-image.png

    1 person found this answer helpful.
    0 comments
  4. Jan Stodola 26 Reputation points
    2022-07-06T12:07:16.417+00:00

    Hi Clive, thank you for your response.
    Yes, I am aware of the above article. What I am interested in are the warnings or errors that are serious and actionable from Sentinel user side. (We do not have ingestion limits in our solutions).

    0 comments