Enabling Microsoft Sentinel

Once you have created a Log Analytics workspace that you want to use with Microsoft Sentinel, it is very easy to attach it to Microsoft Sentinel:

1. If you do not have Microsoft Sentinel enabled for your tenant, sign in to the Azure portal, enter Microsoft Sentinel in the search box, and select the Microsoft Sentinel option, as shown here:

   Figure 2.10 – Launching Microsoft Sentinel

2. Click the Add button to add a workspace to Microsoft Sentinel:

   Figure 2.11 – Adding a workspace to Microsoft Sentinel

3. Select the workspace from the list provided or click Create a new workspace to add a new workspace using the instructions listed in Creating a workspace using the portal section, and then select it. Then, click the Add Microsoft Sentinel button at the bottom of the screen to continue:

   Figure 2.12 – Choosing a workspace

4. Once the workspace has been created, you will be taken to the Overview page of Microsoft Sentinel. This page...