{"id":3017,"date":"2024-03-25T22:36:09","date_gmt":"2024-03-25T21:36:09","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=3017"},"modified":"2024-03-25T22:49:50","modified_gmt":"2024-03-25T21:49:50","slug":"re-onboard-loganalytics-to-sentinel-if-securityinsights-solution-is-deleted-by-mistake","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=3017","title":{"rendered":"Re-onboard LogAnalytics to Sentinel, if SecurityInsights solution is deleted by mistake"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Critical features will break or stop working, if you delete too much in Legacy solutions like SecurityInsights, SQLAdvancedThreatProtection or SQLVulnerabilityAssessment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Background<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Automation and Microsoft Monitoring Agent (MMA) is being retired 31. aug. 2024.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As part of removing these legacy services, you will need to remove <strong>legacy solutions<\/strong> inside Azure LogAnalytics like Updates and Change Tracking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Please don&#8217;t remove all Legacy solutions, as some of them are important for Sentinel and Defender for Cloud:<\/p>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table><tbody><tr><td>Name<\/td><td>Usage<\/td><\/tr><tr><td>SQLAdvancedThreatProtection<br>SQLVulnerabilityAssessment<\/td><td>Used by Microsoft Defender for Cloud for Database Protection<\/td><\/tr><tr><td>SecurityInsights<\/td><td>This solution is important showing that the LogAnalytics workspace has been onboarded to Sentinel. <br><br>If you delete this solution (or have deleted it by mistake), please check the guide below with instructions on how to re-create.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1005\" height=\"401\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-5.png\" alt=\"\" class=\"wp-image-3018\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-5.png 1005w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-5-300x120.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-5-768x306.png 768w\" sizes=\"auto, (max-width: 1005px) 100vw, 1005px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">I deleted SecurityInsights solution and now I cannot use Microsoft Sentinel &#8211; how to fix ?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you have deleted SecurityInsights, you will loose access to the Microsoft Sentinel portal.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can re-create access by running the following Powershell commands:<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>install-module Az\nimport-module Az\n\ninstall-module Az.SecurityInsights\nimport-module Az.SecurityInsights\n\nConnect-AzAccount\nSet-AzContext -Subscription &lt;subscription-id for sub with LogAnalytics workspace&gt;\n\nRemove-AzSentinelOnboardingState -ResourceGroupName \"&lt;rg-name\" -workspaceName \"&lt;LogAnalytics workspacename&gt;\" -Name \"default\"\n \nNew-AzSentinelOnboardingState -ResourceGroupName \"&lt;rg-name\" -workspaceName \"&lt;LogAnalytics workspacename&gt;\" -Name \"default\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>Example\nRemove-AzSentinelOnboardingState -ResourceGroupName \"rg-logworkspaces\" -workspaceName \"log-platform-management-srvnetworkcloud-p\" -Name \"default\"\n \nNew-AzSentinelOnboardingState -ResourceGroupName \"rg-logworkspaces\" -workspaceName \"log-platform-management-srvnetworkcloud-p\" -Name \"default\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now you will have access after approx. 1 min. You will again see all your incidents, connectors, etc.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your Sentinel was connected to the Universal XDR portal, you will need to connect it again in the security.microsoft.com portal.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Critical features will break or stop working, if you delete too much in Legacy solutions like SecurityInsights, SQLAdvancedThreatProtection or SQLVulnerabilityAssessment. &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Re-onboard LogAnalytics to Sentinel, if SecurityInsights solution is deleted by mistake\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=3017#more-3017\" aria-label=\"Read more about Re-onboard LogAnalytics to Sentinel, if SecurityInsights solution is deleted by mistake\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":3018,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[154,54,143,48,133,58],"tags":[],"class_list":["post-3017","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-automation","category-azure-loganalytics","category-azure-logging","category-defender-for-cloud","category-microsoft-security","category-sentinel","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-5.png","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-5.png","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3017","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3017"}],"version-history":[{"count":2,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3017\/revisions"}],"predecessor-version":[{"id":3021,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3017\/revisions\/3021"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/3018"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}