Share via

Is it possible to Store logs outside MS - For Recovery Purposes

Robert Smith 0 Reputation points
2025-04-29T15:20:20.6433333+00:00

I am updating some recovery plans - and I am thinking of a situation where my Sentinel Instance is compromised. and there is a requirement to restore certain components to return to normal asap. so if a new blank instance was created how can I restore certain components Ie Logs, UC, User credentias etc. and does it have to be an MS environment

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,268 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 7,636 Reputation points MVP
    2025-04-30T10:05:31.98+00:00

    This is a big topic so here are a few thoughts

    Workspace replication could be used (but can mean extra costs)
    https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication

    My preference is having a code based deployment for Sentinel can aid in recovery, Terraform, Bicep, DevOps, PowerShell, CLI etc...

    Some other useful links:
    https://learn.microsoft.com/en-us/azure/sentinel/business-continuity-disaster-recovery
    https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export?tabs=portal

    0 comments
  2. Sakshi Devkante 3,335 Reputation points Microsoft External Staff
    2025-04-30T14:52:07.9633333+00:00

    Hello Robert Smith

    Yes, it is possible. Microsoft Sentinel (built on Azure Monitor Logs) supports exporting logs outside of Microsoft Azure, which is crucial for disaster recovery and compromise scenarios.

    Outside of azure (store logs externally):

    Azure Event Hub → External SIEM/S3/Storage

    Use diagnostic settings to stream logs to Azure Event Hub.

    From Event Hub, forward logs to external systems (e.g., Splunk, Elastic, AWS S3, on-prem storage).

    Azure Logic Apps or Functions → External API

    Set up workflows to export logs in near real-time to external systems or storage locations.

    Log Analytics REST API

    Periodically extract logs via API and store them externally (e.g., backup to a secure location outside Azure).

    Export to Azure Storage (Blob or ADLS)

    You can export logs to Azure Storage for long-term retention and then periodically back up that storage to an external environment (e.g., AWS, Google Cloud, or on-prem).

    How can I restore certain components?
    When restoring Sentinel from a backup, the components are not automatically backed up as part of Sentinel. Restore archived logs from search

    Component Backup Method Restore Notes
    Log Data Stream to external SIEM or storage Can be re-ingested via API or scripts
    Log Data Stream to external SIEM or storage Can be re-ingested via API or scripts
    Analytics Rules (UCs) Use ARM templates, Azure CLI, or Sentinel as Code Can be redeployed in new instance
    Workbooks Export to JSON or ARM templates Import into new Sentinel
    Hunting Queries Save to GitHub or external repo Redeploy manually
    Watchlists Export to CSV/JSON Reimport manually
    User Access & RBAC Export using Azure PowerShell / Graph API Recreate RBAC assignments manually or via script
    Playbooks (Logic Apps) Export Logic Apps definition (ARM) Redeploy in new region/subscription
    Custom Connectors Save connector definitions Recreate in new instance

    Does it have to be an MS environment?
    No, not necessarily. While Sentinel itself is Microsoft-native, your log backup and DR strategy does not have to remain in Microsoft Azure.

    You can:

    Store logs in AWS S3, Google Cloud Storage, on-prem, or any secure location.

    Use third-party SIEMs or log archiving tools as a fallback or "cold" DR storage.

    Maintain templates/configs in a GitOps approach (store Sentinel configs in GitHub/GitLab, etc.)

    Check these articles for more details:
    Business continuity and disaster recovery for Microsoft Sentinel
    Recommendations for designing a disaster recovery strategy
    Export data from a Log Analytics workspace to a storage account by using Logic Apps
    Log Analytics workspace data export in Azure Monitor

    I hope this clarifies things.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.