Viewing Events and Detections in Microsoft Sentinel

To view data using logs:

1. Go to the Sentinel page and click Logs. The Logs page opens.

   

2. On the Logs page Run KQL to pull and show data.
   1. To see raw data for each category:

      Suricata	FncEventsSuricata_CL
      Observation	FncEventsObservation_CL
      Detections	FncEventsDetections_CL

      

   2. To view normalized data for each category, click Functions > WorkSpace functions, hover over Fortinet_FortiNDR_Cloud and select Use in editor. This will add the normalize function for all data types.

      Suricata	Fortinet_FortiNDR_Cloud | where Type == 'FncEventsSuricata_CL'
      Observation	Fortinet_FortiNDR_Cloud | where Type == 'FncEventsObservation_CL'
      Detections	Fortinet_FortiNDR_Cloud | where Type == 'FncEventsDetections_CL'

      

      You can use the date-range selector to select the range the data was posted in Sentinel. If No Results is displayed, extend the date-range.

To view data using Sentinel Workbooks:

1. Go to the Sentinel Workbooks page then select Template, and View Template.

   

2. Inside the default workbook template, we provide data visualization for three Event types: Suricata, Observation, and Detections. Click the event tabs, to see data in correlated types as charts and grids. Each event type can be filtered.

   Main dashboard:

   

   Suricata dashboard:

   

   Observation dashboard:

   

   Detection dashboard: