SecurityInsight settings · Settings > Sign-in & Azure resources
Defender data workspace
| Key | SI_DefenderWorkspaceResourceId |
|---|---|
| Where | Settings > Sign-in & Azure resources > Log Analytics |
| Type | Text |
| Default | Not set: Defender data is read from the SecurityInsight workspace |
| Edition | Community |
What it does
Full resource id of a separate Log Analytics workspace holding Defender data, when it is not the SecurityInsight workspace.
When set
Identity discovery and Risk Analysis queries read Defender tables from this workspace. A wrong value makes those queries return nothing or fail.
When blank or default
Left blank, the default applies: Not set: Defender data is read from the SecurityInsight workspace
Risk and how to reverse it
Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.
Requires
Read by: endpoint.
Recommended
Keep the default. Change it when: Only when your Defender data is in a different workspace than SecurityInsight's own.
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack