By SOC Prime Team
Publication Date: 2026-10-30 09:35:00
Sentinel data lives in a Log Analytics workspace, so an export is a KQL query plus a way to save the results as JSON. The simplest is the Azure CLI: az monitor log-analytics query returns one JSON object per row. The portal’s export button produces a spreadsheet-style file that LogTotal doesn’t read today, so use the CLI or PowerShell for uploads.
Sentinel collects from everywhere: Windows, Linux, Entra ID, Microsoft 365, firewalls, clouds. That makes it the natural place to pull an investigation slice from. Prime Core has 23,700 detection rules for Microsoft Sentinel, mapped to 674 MITRE ATT&CK techniques. Below is how to get the data out, sanitize it, and investigate it for free in LogTotal.
Before you start
Permissions. Log Analytics Reader or Microsoft Sentinel Reader on the workspace is enough.
The workspace ID. The CLI wants the workspace GUID, from the workspace’s overview page, not its name.
Know your…
