Sentinel - Azure Activity Connector - log collection coverage
Sentinel Azure Activity Data Connector Coverage
Query
// Identify Azure Subscriptions that are not monitored by the Azure Activity Data Connector in Sentinel
let allsubscriptions =
arg("").resourcecontainers
| where type == "microsoft.resources/subscriptions"
| distinct subscriptionId, name;
allsubscriptions
| join kind=leftouter (AzureActivity
| extend AzureActivitySyubscriptionId = SubscriptionId
| distinct AzureActivitySyubscriptionId)
on $left. subscriptionId == $right.AzureActivitySyubscriptionId
| extend IsMonitored = iff(isempty(AzureActivitySyubscriptionId),"No","Yes")
| project subscriptionId, name, AzureActivitySyubscriptionId, IsMonitoredAbout this query
Sentinel - Azure Activity Connector - log collection coverage
Query Information
Description
Use the below query to Identify Azure Subscriptions that are not monitored by the Azure Activity Data Connector in Sentinel
References
- Azure Activity connector for Microsoft Sentinel
- Moving Azure Activity Connector to an improved method
Microsoft Sentinel
Explanation
This query is used to identify Azure Subscriptions that are not monitored by the Azure Activity Data Connector in Sentinel. It retrieves all Azure subscriptions and then joins them with the AzureActivity table to determine if they are being monitored or not. The result includes the subscription ID, name, Azure Activity subscription ID, and a flag indicating if it is being monitored or not.
Details
Alex Verboon
Released: September 18, 2023
Tables
AzureActivity
Keywords
AzureSubscriptionsAzure Activity Data ConnectorSentinel
Operators
argresourcecontainerswheretypedistinctjoinkindextendon$left.$right.isemptyiffproject