![]() ![]() You may also have cost implications to each strategy. Combining them gives you better visibility across all your data, while your security standards might require separating them so that your security team has a dedicated workspace. You may choose to combine operational data from Azure Monitor in the same workspace as security data from Microsoft Sentinel or separate each into their own workspace. The sections that follow describe the criteria. ![]() The following table presents criteria to consider when you design your workspace architecture. Consider your requirements and priorities to determine which design will be most effective for your environment. Evaluate each of the criteria independently. Consolidating into a single workspace might allow you to reduce charges even more with a commitment tier. For example, you might be able to reduce egress charges by creating a separate workspace in each Azure region. But some of the criteria might be in conflict. As you identify criteria to create more workspaces, your design should use the fewest number that will match your requirements.ĭesigning a workspace configuration includes evaluation of multiple criteria. Multiple services and data sources can send data to the same workspace. There are no performance limitations from the amount of data in your workspace. Your design should always start with a single workspace to reduce the complexity of managing multiple workspaces and in querying data from them. If you use only one of these services, you can ignore the other in your evaluation. Most of the decision criteria apply to both services. This article discusses Azure Monitor and Microsoft Sentinel because many customers need to consider both in their design. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |