SecurityInsight settings · Settings > Risk Analysis reports

Copy Risk Analysis report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL)

Key	SendToLogAnalytics
Where	Settings > Risk Analysis reports > Report mode and output
Type	On / off
Default	Off: the report rows are kept in the database only
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

Optional. After each Risk Analysis run, copies its report rows into your Log Analytics workspace (SI_RiskAnalysis_Detailed_CL, and SI_RiskAnalysis_Summary_CL when the Summary report runs; the day's trend row in SI_Trend_CL), for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages, the data sync, the vulnerability connectors and the trends read the results from its database. On a large estate the copy takes a long time and adds Log Analytics ingestion cost. Off by default.

When enabled

after every Risk Analysis run its report rows are also posted to SI_RiskAnalysis_Detailed_CL (SI_RiskAnalysis_Summary_CL for the Summary report), after the result is complete in the database, and the day's trend row to SI_Trend_CL. On a large estate that is close to an hour, and it costs ingestion for every row, every run.

When disabled

nothing is copied; the Excel reports, the mail and everything SecurityInsight shows are unchanged. The Azure workbook in preview\AzureWorkbook reads the copy, so it needs it on.

Risk and how to reverse it

Log Analytics ingestion cost for every report row, every run, and a longer run on a large estate. SecurityInsight itself does not need the copy: its pages, the data sync, the vulnerability connectors and the trends read the database. Reversible: turn it off and the next run copies nothing.

Requires

Read by: risk-analysis.