How to Export Logs from Microsoft Sentinel

Sentinel data lives in a Log Analytics workspace, so an export is a KQL query plus a way to save the results as JSON. The simplest is the Azure CLI: az monitor log-analytics query returns one JSON object per row. The portal’s export button produces a spreadsheet-style file that LogTotal doesn’t read today, so use the CLI or PowerShell for uploads.

Sentinel collects from everywhere: Windows, Linux, Entra ID, Microsoft 365, firewalls, clouds. That makes it the natural place to pull an investigation slice from. Prime Core has 23,700 detection rules for Microsoft Sentinel, mapped to 674 MITRE ATT&CK techniques. Below is how to get the data out, sanitize it, and investigate it for free in LogTotal.

Get Started For Free

Before you start

Permissions. Log Analytics Reader or Microsoft Sentinel Reader on the workspace is enough.

The workspace ID. The CLI wants the workspace GUID, from the workspace’s overview page, not its name.

Know your tables. The ones that matter most: SecurityEvent (Windows), Syslog (Linux), SigninLogs and AuditLogs (Entra ID), OfficeActivity (Microsoft 365), CommonSecurityLog (CEF from firewalls and other appliances), AzureActivity, plus any custom _CL tables.

Retention tiers. Data in interactive retention can be queried directly. Data that has aged into long-term retention can’t: you need a search job or a restore first. Some table plans (Basic, Auxiliary) also limit what KQL can do.

Where you write KQL. Depending on how your tenant is set up, that’s Advanced hunting in the Microsoft Defender portal or Logs in the Azure portal. The queries are the same.

The commands follow Microsoft’s documentation, checked October 2026.

Step 1: Write the query

Keep it to events. No summarize if you want logs back. For Linux SSH activity:

Syslog
| where TimeGenerated between (datetime(2026-10-19) .. datetime(2026-10-20))
| where Computer == "web-03"
| where ProcessName in ("sshd", "sshd-session")

For Windows logons and account changes on a domain controller:

SecurityEvent
| where TimeGenerated between (datetime(2026-10-19) .. datetime(2026-10-20))
| where Computer startswith "DC-01"

Run it in the portal first and check the row count.

Step 2: Export as JSON

Azure CLI:

az login
az monitor log-analytics query \
  --workspace <workspace-guid> \
  --analytics-query "Syslog | where TimeGenerated between (datetime(2026-10-19) .. datetime(2026-10-20)) | where Computer == 'web-03'" \
  --output json > sentinel_web03_1019.json

jq -c '.[]' sentinel_web03_1019.json > sentinel_web03_1019.jsonl

The first run may ask to install the log-analytics extension. Say yes.

PowerShell (Az module):

Connect-AzAccount
$kql = "SecurityEvent | where TimeGenerated between (datetime(2026-10-19) .. datetime(2026-10-20)) | where Computer startswith 'DC-01'"
(Invoke-AzOperationalInsightsQuery -WorkspaceId '<workspace-guid>' -Query $kql).Results |
  ForEach-Object { $_ | ConvertTo-Json -Compress } | Out-File sentinel_dc01_1019.jsonl -Encoding utf8

Query results are capped in rows and size. For busy tables, split the window into hours and run the export once per slice.

Step 3: Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the .jsonl file. 
2. Sanitize. 
3. Review. 

When it goes wrong