An introduction to the Microsoft Sentinel Logs page

The Log Analytics workspace follows a hierarchical pattern regarding how it organizes its information. At the top is the Log Analytics workspace. This is the container for all the individual tables for your instance of Microsoft Sentinel. This is equivalent to a database in SQL.

Within each workspace are individual tables. These are equivalent to a table in SQL and are the entities that hold data. They have a set of columns and zero or more rows of data.

Within each of those tables are the columns that hold the data. The columns can hold different data types including text, date/time, integers, and others.

Note

A lot of the documentation you will read will use the terms table and log interchangeably. We are choosing to use the term table, as that is the term Microsoft uses inside the Logs page and most documentation, even though the page itself is called Logs.