Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The MicrosoftSentinel.Contents function imports data from your Sentinel KQL instance.
Summary
| Property | Value |
|---|---|
| Connector |  Microsoft Sentinel |
| Products | Power BI (semantic models) Power Query Online |
| Release state | Preview |
| Category | Other |
| Authentication kinds | Microsoft Entra ID |
| Data source kind | MicrosoftSentinel |
| Function Reference Documentation | MicrosoftSentinel.Contents |
Supported capabilities
Entry point: MicrosoftSentinel.Contents
- DirectQuery
Parameters
Entry point: MicrosoftSentinel.Contents
Required parameter count: 1
Imports data from Sentinel KQL
Imports data from your Sentinel KQL instance
| Parameter | Display name | Required | Type | Group | Declared default | Sample values | Nullable | Additional metadata |
|---|---|---|---|---|---|---|---|---|
| cluster | Cluster | Yes | text | "https://api.securityplatform.microsoft.com/lake/kql" | "https://api.securityplatform.microsoft.com/lake/kql" | false | ||
| database | Database | No | nullable text | "MyDatabase" | true | |||
| tableOrQuery | Table name or Azure Data Explorer query | No | nullable text | "Logs | where [Timestamp] > ago(1h)"; "TracesTable" | true | {"Formatting.IsCode": true, "Formatting.IsMultiLine": true} | ||
| options | Advanced options | No | nullable record | Advanced options | true |
Fields in options
| Field | Display name | Required | Type | Group | Sample values | Nullable | Optional |
|---|---|---|---|---|---|---|---|
| options.MaxRows | Limit query result record number | No | number | Advanced options | "500000" | false | true |
| options.MaxSize | Limit query result data size in Bytes | No | number | Advanced options | "67108864" | false | true |
| options.NoTruncate | Disable result-set truncation | No | logical | Advanced options | "false" | false | true |
| options.AdditionalSetStatements | Additional Set Statements (separated by semicolons) | No | text | Advanced options | "set query_datascope=hotcache;" | false | true |
| options.start | Start time - Exact datetime or duration literals relative to current time | No | text | Advanced options | "2026-06-01T00:00:00Z, 2026-06-01, 5h, 5d" | false | true |
| options.end | End time - Exact datetime or duration literals relative to current time | No | text | Advanced options | "2026-06-01T01:00:00Z, 2026-06-01, 1h, 1d" | false | true |