Manage Table Log For Free

Microsoft Sentinel is billed for the volume of data analyzed in Microsoft Sentinel and stored in Azure Monitor Log Analytics workspace. Data can be ingested as two different types of logs: Analytics Logs and Basic Logs.

One the limitations of Basic Logs is that it only supports a subset of the KQL operators, which means you won't be able to utilize Basic Logs data for Analytics Rules and other necessary Microsoft Sentinel functions.

Log Analytics collects data from the Connected Sources in your OMS workspace and stores it in OMS repository. The data that is collected from each is defined by the Data Sources that you configure. Data in the OMS repository is stored as a set of records.

Set up Log Analytics for an existing service In the Azure portal, go to the Diagnostic settings section under Monitoring. If no settings exist, select Add diagnostic setting. You can also select Edit setting to update existing settings. Fill out the form on the Diagnostic setting page: ... Select Save.

Basic Logs provides a lower cost option for ingestion of high-volume, verbose logs into your Log Analytics workspace. Event log data in Basic Logs can't be used as the primary log source for security incidents and alerts.

Or use these steps: In the Azure portal, select Log Analytics Workspaces. Choose a Log Analytics workspace. Under Monitoring, select Insights on the workspace menu.

Basic Logs tables reduce the cost of ingesting high-volume verbose logs and let you query the data they store using a limited set of log queries. This article explains how to query data from Basic Logs tables. For more information, see Set a table's log data plan.

Types of logs in Azure Log categoryLog typeActivity logsControl-plane events on Azure Resource Manager resourcesAzure Resource logsFrequent data about the operation of Azure Resource Manager resources in subscriptionAzure Active Directory reportingLogs and reports5 more rows ? 29-Aug-2023

Azure portal: You can view and query your data directly from the Azure portal. Simply go to your Log Analytics Workspace, select the "Logs" option, and start writing queries to retrieve the data you need. REST API: You can use the Log Analytics REST API to programmatically retrieve data from your workspace.

To create a custom table in the Azure portal: From the Log Analytics workspaces menu, select Tables. Select Create and then New custom log (DCR-based). Specify a name and, optionally, a description for the table.