Microsoft Sentinel Best Practice for Admin Users

[@JackSmith-oy7rx]

at 16.59 for the log analytics query logs table, do you mean the Activity log for the LA resource?

[@CraigCloudITPro]

Hey Jack, so the LA query logs table is for SOC users that are running queries inside the specified Log Analytics Workspace

[@CraigCloudITPro]

You can audit activities with Azure Activity of course, but the LA query logs is specified at which table and queries were ran, I hope that helps :)