Working with Livestream

Livestream is a new feature for Azure Sentinel that will allow you to watch one or more hunting queries in real time, to see new results as they occur. This can be useful when performing an investigation, to watch whether a query has any new results without having to constantly rerun the query.

Note

At the time of writing this book, the Livestream feature was still in preview and, as such, the features and functionality may have changed.

Looking back at Figure 10.8, the last entry in the context menu is called Add to livestream. Selecting this will add the query to the Livestream window, as follows:

Figure 10.9 – Adding a query to Livestream

While this query is added to Livestream, it is not yet running. Click on the Open livestream button on the bottom of the query's detail page. If there is more than one query listed on the page, make sure to select the query you want to watch before clicking this button.

This...