Choosing Not to See Tables without Data in the Microsoft Sentinel Console

I often hear from customers who notice a new table or two show up in the list of Tables in Microsoft Sentinel.

(EXTRA: I talk about the Table list in Part 7 of the Must Learn KQL series)

Customers get excited when this happens because it’s usually evidence that a new Data Connector or parts of a preview Data Connector will go live soon. It’s a good way to monitor what we’re working on releasing soon.

But until the table has actual data, there’s really no reason to have it sitting, taking up space in the console. For some it can be a distraction.

Here’s a tip. If you don’t want to be distracted by tables that contain no data, you can use the toggle switch built into the UI.

Once data starts populating, the tables will show up in the normal Table list. That’s when you can start to get excited that we’re pushing a new table into public preview or GA.

Incidentally, there are ways to also eliminate the empty data columns in your query results. See Must Learn KQL Part 7: Schema Talk for more on that.

=========================

[Want to discuss this further? Hit me up on Twitter or LinkedIn]

[Subscribe to the RSS feed for this blog]

[Subscribe to the Weekly Microsoft Sentinel Newsletter]

[Subscribe to the Bi-Weekly Defender for Cloud Newsletter]