How to Export Microsoft Sentinel Logs for Investigation
Summary
A guide to querying Sentinel data with KQL and exporting results as JSON or JSONL using Azure CLI or PowerShell, with notes on permissions, retention, and query limits. It also describes uploading the files to LogTotal at logtotal[.]com.
Key points
- The article recommends Azure CLI or PowerShell to export Sentinel query results as JSON or JSONL; the portal’s spreadsheet-style export is described as incompatible with LogTotal.
- It provides KQL examples for Linux SSH activity in Syslog and Windows events in SecurityEvent.
- Log Analytics Reader or Microsoft Sentinel Reader permissions and the workspace GUID are needed for the described queries.
- Interactive-retention data can be queried directly; long-term-retention data requires a search job or restore first.
- For busy tables, split the query time window into smaller slices because result rows and size are capped.
Article Details
- Defense Focus
- Export and review Microsoft Sentinel log data for investigations.
- Detection Methods
- Use KQL filters on Syslog to review Linux SSH activity by time range, computer, and process name.
- Use KQL filters on SecurityEvent to review Windows logons and account changes on a domain controller.
- Data Sources
- SecurityEvent
- Syslog
- SigninLogs
- AuditLogs
- OfficeActivity
- CommonSecurityLog
- AzureActivity
- Custom _CL tables
- Defender data queried alongside Sentinel tables through advanced hunting
- Rule Types
- KQL queries
- Platforms
- Microsoft Sentinel
- Log Analytics
- Azure portal
- Microsoft Defender portal
- LogTotal
- Defensive Actions
- Query the workspace and verify the result row count in the portal before exporting.
- Export query results as JSON or JSONL using Azure CLI or PowerShell.
- For busy tables or result limits, split the time window into smaller slices and run separate exports.
- For data in long-term retention, run a search job or restore the data before querying.
- Upload the JSONL file to LogTotal, then sanitize and review it.
Vendors
Products
Log AnalyticsSentinel data lives in a Log Analytics workspace, so an export is a KQL query plus a way to save the results as JSON.LogTotalThe portal’s export button produces a spreadsheet-style file that LogTotal doesn’t read today, so use the CLI or PowerShell for uploads.Microsoft Defender portalDepending on how your tenant is set up, that’s Advanced hunting in the Microsoft Defender portal or Logs in the Azure portal.Microsoft Defender XDRWhat about Defender XDR data in Sentinel?Microsoft SentinelPrime Core has 23,700 detection rules for Microsoft Sentinel, mapped to 674 MITRE ATT&CK techniques.