An introduction to the Azure Sentinel Logs page
The Log Analytics workspace follows a hierarchical pattern regarding how it organizes its information. At the top is the Log Analytics workspace. This is the container for all the individual logs for your instance of Azure Sentinel. This is equivalent to a database in SQL.
Within each workspace are individual logs, also known as tables. These are equivalent to a table in SQL. These are the entities that hold data. These have a set of columns, and zero or more rows of data.
Within each of those logs are the columns that hold the data. The columns can hold different data types, including text, date/time, integers, and others.
Note
A lot of the documentation you will read will use the terms table and log interchangeably. We are choosing to use the term log, as that seems to be the default, with the understanding that Microsoft may change the wording of various parts of the Logs page and references in the documentation at a later...
