Why is there no data in my Azure Sentinel?

image

If you find that no data is flowing into your Azure Sentinel workspace then check the data connectors as shown above. You should see that the Data types are connected and actual events are appearing.

image

If you actually Open connector page you should firstly see that the data source is connected (in the top right). In the lower left you should see the connected sources as well as the log counts. However, if you see no data then the most likely cause is that you have not completed the Configuration settings (here selecting Exchange and SharePoint option).

image

Another way to check is to select the Logs option on the left menu and then run an ad hoc query against some of the data sources as shown above. that should produce some low level logs that confirm data is being ingested.

Azure Sentinel Data Connectors have different configurations, so if you are not seeing any data inside Sentinel, check that you have all the configuration options enabled and connected inside each connector.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s