You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/summary-rules-tutorial.md
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,8 +19,7 @@ ms.collection: usx-security
19
19
This article provides an example of how to use summary rules to aggregate insights from an [auxiliary logs table](basic-logs-use-cases.md) to an Analytics table. In this example, you ingest Common Event Format (CEF) data from Logstash by deploying a custom connector using an ARM template.
20
20
21
21
> [!IMPORTANT]
22
-
> Summary rules are currently in PREVIEW. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
23
-
>
22
+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
Copy file name to clipboardExpand all lines: articles/sentinel/summary-rules.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Aggregate Microsoft Sentinel data with summary rules (Preview)
2
+
title: Aggregate Microsoft Sentinel data with summary rules
3
3
description: Learn how to aggregate large sets of Microsoft Sentinel data across log tiers with summary rules.
4
4
author: guywi-ms
5
5
ms.author: guywild
@@ -14,7 +14,7 @@ ms.collection: usx-security
14
14
15
15
---
16
16
17
-
# Aggregate Microsoft Sentinel data with summary rules (Preview)
17
+
# Aggregate Microsoft Sentinel data with summary rules
18
18
19
19
Use prebuilt or custom [summary rules](/azure/azure-monitor/logs/summary-rules) in Microsoft Sentinel to aggregate insights at a regular cadence from large sets of data in any log tier, including the [auxiliary log tier](billing.md#auxiliary-logs). Working with summarized data enhances query performance and helps optimize your data for:
20
20
@@ -27,7 +27,7 @@ Microsoft Sentinel stores summary rule results in custom tables with the **Analy
27
27
This article explains how to create summary rules or deploy pre-built summary rule templates in Microsoft Sentinel, and provides examples of common scenarios for using summary rules.
28
28
29
29
> [!IMPORTANT]
30
-
> Summary rules are currently in PREVIEW. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
30
+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
@@ -50,9 +50,9 @@ Create a new summary rule to aggregate a specific large set of data into a dynam
50
50
51
51
1. Open the Summary rule wizard:
52
52
53
-
- In the Defender portal, select **Microsoft Sentinel > Configuration > Summary rules (Preview)**.
54
-
55
-
- In the Azure portal, from the Microsoft Sentinel navigation menu, under **Configuration**, select **Summary rules (Preview)**. For example:
53
+
- In the Defender portal, select **Microsoft Sentinel > Configuration > Summary rules**.
54
+
55
+
- In the Azure portal, from the Microsoft Sentinel navigation menu, under **Configuration**, select **Summary rules**. For example:
56
56
57
57
:::image type="content" source="media/summary-rules/summary-rules-azure.png" alt-text="Screenshot of the Summary rules page in the Azure portal." lightbox="media/summary-rules/summary-rules-azure.png":::
58
58
@@ -100,7 +100,7 @@ Create a new summary rule to aggregate a specific large set of data into a dynam
100
100
101
101
1. Select **Next: Review + create >** > **Save** to complete the summary rule.
102
102
103
-
Existing summary rules are listed on the **Summary rules (Preview)** page, where you can review your rule status. For each rule, select the options menu at the end of the row to take any of the following actions:
103
+
Existing summary rules are listed on the **Summary rules** page, where you can review your rule status. For each rule, select the options menu at the end of the row to take any of the following actions:
104
104
105
105
- View the rule's current data in the **Logs** page, as if you were to run the query immediately
106
106
- View the run history for the selected rule
@@ -143,7 +143,7 @@ To deploy a summary rule template:
143
143
144
144
## Sample summary rule scenarios in Microsoft Sentinel
145
145
146
-
This section reviews common scenarios for creating summary rules in Microsoft Sentinel, and our recommendations for how to configure each rule. For more information and examples, see [Summarize insights from raw data in an Auxiliary table to an Analytics table in Microsoft Sentinel (Preview)](./summary-rules-tutorial.md) and [Log sources to use for Auxiliary Logs ingestion](basic-logs-use-cases.md).
146
+
This section reviews common scenarios for creating summary rules in Microsoft Sentinel, and our recommendations for how to configure each rule. For more information and examples, see [Summarize insights from raw data in an Auxiliary table to an Analytics table in Microsoft Sentinel](./summary-rules-tutorial.md) and [Log sources to use for Auxiliary Logs ingestion](basic-logs-use-cases.md).
147
147
148
148
### Quickly find a malicious IP address in your network traffic
0 commit comments