You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/summary-rules-tutorial.md
+2-4Lines changed: 2 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Summarize insights from raw data in an Auxiliary table to an Analytics table in Microsoft Sentinel (Preview)
2
+
title: Summarize insights from raw data in an Auxiliary table to an Analytics table in Microsoft Sentinel
3
3
description: This article walks you through a sample process of using summary rules to extract actionable analytics from verbose logs ingested into low-cost storage.
4
4
author: guywi-ms
5
5
ms.author: guywild
@@ -14,13 +14,11 @@ ms.collection: usx-security
14
14
15
15
---
16
16
17
-
# Tutorial: Send logs to low-cost storage and extract actionable analytics using summary rules in Microsoft Sentinel (Preview)
17
+
# Tutorial: Send logs to low-cost storage and extract actionable analytics using summary rules in Microsoft Sentinel
18
18
19
19
This article provides an example of how to use summary rules to aggregate insights from an [auxiliary logs table](basic-logs-use-cases.md) to an Analytics table. In this example, you ingest Common Event Format (CEF) data from Logstash by deploying a custom connector using an ARM template.
20
20
21
21
> [!IMPORTANT]
22
-
> Summary rules are currently in PREVIEW. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
Copy file name to clipboardExpand all lines: articles/sentinel/summary-rules.md
+7-10Lines changed: 7 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Aggregate Microsoft Sentinel data with summary rules (Preview)
2
+
title: Aggregate Microsoft Sentinel data with summary rules
3
3
description: Learn how to aggregate large sets of Microsoft Sentinel data across log tiers with summary rules.
4
4
author: guywi-ms
5
5
ms.author: guywild
@@ -14,7 +14,7 @@ ms.collection: usx-security
14
14
15
15
---
16
16
17
-
# Aggregate Microsoft Sentinel data with summary rules (Preview)
17
+
# Aggregate Microsoft Sentinel data with summary rules
18
18
19
19
20
20
Use [summary rules](/azure/azure-monitor/logs/summary-rules) in Microsoft Sentinel to aggregate large sets of data in the background for a smoother security operations experience across all log tiers. Summary data is precompiled in custom log tables and provide fast query performance, including queries run on data derived from [low-cost log tiers](billing.md#data-lake-tier). Summary rules can help optimize your data for:
@@ -28,10 +28,7 @@ Microsoft Sentinel stores summary rule results in custom tables with the **Analy
28
28
This article explains how to create summary rules or deploy pre-built summary rule templates in Microsoft Sentinel, and provides examples of common scenarios for using summary rules.
29
29
30
30
> [!IMPORTANT]
31
-
> Summary rules are currently in PREVIEW. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
@@ -51,9 +48,9 @@ Create a new summary rule to aggregate a specific large set of data into a dynam
51
48
52
49
1. Open the Summary rule wizard:
53
50
54
-
- In the Defender portal, select **Microsoft Sentinel > Configuration > Summary rules (Preview)**.
55
-
56
-
- In the Azure portal, from the Microsoft Sentinel navigation menu, under **Configuration**, select **Summary rules (Preview)**. For example:
51
+
- In the Defender portal, select **Microsoft Sentinel > Configuration > Summary rules**.
52
+
53
+
- In the Azure portal, from the Microsoft Sentinel navigation menu, under **Configuration**, select **Summary rules**. For example:
57
54
58
55
:::image type="content" source="media/summary-rules/summary-rules-azure.png" alt-text="Screenshot of the Summary rules page in the Azure portal." lightbox="media/summary-rules/summary-rules-azure.png":::
59
56
@@ -101,7 +98,7 @@ Create a new summary rule to aggregate a specific large set of data into a dynam
101
98
102
99
1. Select **Next: Review + create >** > **Save** to complete the summary rule.
103
100
104
-
Existing summary rules are listed on the **Summary rules (Preview)** page, where you can review your rule status. For each rule, select the options menu at the end of the row to take any of the following actions:
101
+
Existing summary rules are listed on the **Summary rules** page, where you can review your rule status. For each rule, select the options menu at the end of the row to take any of the following actions:
105
102
106
103
- View the rule's current data in the **Logs** page, as if you were to run the query immediately
107
104
- View the run history for the selected rule
@@ -144,7 +141,7 @@ To deploy a summary rule template:
144
141
145
142
## Sample summary rule scenarios in Microsoft Sentinel
146
143
147
-
This section reviews common scenarios for creating summary rules in Microsoft Sentinel, and our recommendations for how to configure each rule. For more information and examples, see [Summarize insights from raw data in an Auxiliary table to an Analytics table in Microsoft Sentinel (Preview)](./summary-rules-tutorial.md) and [Log sources to use for Auxiliary Logs ingestion](basic-logs-use-cases.md).
144
+
This section reviews common scenarios for creating summary rules in Microsoft Sentinel, and our recommendations for how to configure each rule. For more information and examples, see [Summarize insights from raw data in an Auxiliary table to an Analytics table in Microsoft Sentinel](./summary-rules-tutorial.md) and [Log sources to use for Auxiliary Logs ingestion](basic-logs-use-cases.md).
148
145
149
146
### Quickly find a malicious IP address in your network traffic
0 commit comments