Microsoft Sentinel
Cloud and workloadsMicrosoft Sentinel Migration: Ingest Data into Target Platform
In brief
The article now more clearly describes exporting legacy SIEM data and ingesting it into Microsoft Sentinel data lake, Azure Data Explorer (ADX), or Azure Blob Storage. ADX steps and links were revised, including explicit Windows requirements for LightIngest.
What Defender admins need to know
Administrators can use the clearer migration steps and platform-specific guidance when planning historical data ingestion. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
title: "Microsoft Sentinel migration:Migration: Ingest dataData into target platformTarget Platform"
description: Learn how to ingest historical data into your selected target platform.
author: EdB-MSFT
ms.author: edbaynash
ms.topic: how-to
ms.date: 06/15/07/01/2026
ai-usage: ai-assisted
ms.custom: msecd-doc-authoring-10141016
#Customer intent: As a data engineer, I want to ingest historical data into my target platform so that I can ensure seamless data migration and integration for analysis and reporting.
Ingest historical data into your target platform
In previous articles,To ingest exported historical SIEM data into a target platform, first ensure you have chosen a target platform for historical data. You also, selected a data transfer tool for migration ingestion, and stored the historical data in a staging location. You can now start to ingest the data into the target platform.
This article describes how to export data from your legacy SIEM and ingest your historical data into your selected target platform.Microsoft Sentinel data lake, Azure Data Explorer, or Azure Blob Storage.
Export data from the legacy SIEM
Microsoft Sentinel data lake is the native data layer of the Microsoft Sentinel platform. It's the simplest path to a unified, queryable history of your security data inside Microsoft Sentinel and the recommended platform for long-term data retention.
To ingest your historical data into Microsoft Sentinel data lake (option 1(as shown in the export and ingestion process diagram), use the Custom Log Ingestion tool.
Ingest to Azure Data Explorer (ADX)
Azure Data Explorer (ADX) is a fast, scalable data exploration service. To ingest your historical data into Azure Data Explorer (ADX) (option 2 in the diagram above):ADX:
- LightIngest supports Windows only. Install and configure LightIngest on the Windows system where logs are exported, or install LightIngest on another Windows system that has access to the exported logs.
LightIngest supports Windows only. - If you don't have an existing ADX cluster, create a new cluster and copy the connection string. Learn how to set up ADX.
- In ADX, create tables and define a schema for the CSV or JSON format (for QRadar). Learn how to
create a table and define a schemacreate a table and define a schema using sample data or create a table and define a schema without sample data. - Run LightIngest with the folder path that includes the exported logs as the path, and the ADX connection string as the output. When you run LightIngest, ensure that you provide the target ADX table name, that the argument pattern is set to
*.csv, and the format is set to.csv(orjsonfor QRadar).
Ingest to Azure Blob Storage
To ingest your historical data into Azure Blob Storage (option 3 in the diagram above):Storage:
- Install and configure AzCopy on the system to which you exported the logs. Alternatively, install AzCopy on another system that has access to the exported logs.
- Create an Azure Blob Storage account and copy the authorized Microsoft Entra ID credentials or Shared Access Signature token.
- Run AzCopy with the folder path that includes the exported logs as the source, and the Azure Blob Storage connection string as the output.
Next step
Now that you ingested historical data into your target platform, convert your dashboards to workbooks.
[!div class="nextstepaction"] Convert your dashboards to workbooks
@@ -1,12 +1,12 @@ ----title: "Microsoft Sentinel migration: Ingest data into target platform"+title: "Microsoft Sentinel Migration: Ingest Data into Target Platform" description: Learn how to ingest historical data into your selected target platform. author: EdB-MSFT ms.author: edbaynash ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/01/2026 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a data engineer, I want to ingest historical data into my target platform so that I can ensure seamless data migration and integration for analysis and reporting.@@ -15,9 +15,9 @@ ms.custom: msecd-doc-authoring-1014 # Ingest historical data into your target platform -In previous articles, you [selected a target platform for your historical data](migration-ingestion-target-platform.md). You also selected [a data transfer tool for migration ingestion](migration-ingestion-tool.md) and stored the historical data in a staging location. You can now start to ingest the data into the target platform. +To ingest exported historical SIEM data into a target platform, first ensure you have chosen a [target platform for historical data](migration-ingestion-target-platform.md), selected a [data transfer tool for migration ingestion](migration-ingestion-tool.md), and stored the data in a staging location. -This article describes how to ingest your historical data into your selected target platform.+This article describes how to export data from your legacy SIEM and ingest historical data into Microsoft Sentinel data lake, Azure Data Explorer, or Azure Blob Storage. ## Export data from the legacy SIEM @@ -37,29 +37,28 @@ To export data from your current SIEM, see one of the following sections: Microsoft Sentinel data lake is the native data layer of the Microsoft Sentinel platform. It's the simplest path to a unified, queryable history of your security data inside Microsoft Sentinel and the recommended platform for long-term data retention. -To ingest your historical data into Microsoft Sentinel data lake (option 1 in the [diagram above](#export-data-from-the-legacy-siem)) use the [Custom Log Ingestion tool](/azure/azure-monitor/logs/tutorial-logs-ingestion-portal).+To ingest your historical data into Microsoft Sentinel data lake (as shown in the [export and ingestion process diagram](#export-data-from-the-legacy-siem)), use the [Custom Log Ingestion tool](/azure/azure-monitor/logs/tutorial-logs-ingestion-portal). -## Ingest to Azure Data Explorer+<a name="ingest-to-azure-data-explorer"></a>+## Ingest to Azure Data Explorer (ADX) -To ingest your historical data into Azure Data Explorer (ADX) (option 2 in the [diagram above](#export-data-from-the-legacy-siem)):+Azure Data Explorer (ADX) is a fast, scalable data exploration service. To ingest your historical data into ADX: -1. [Install and configure LightIngest](/azure/data-explorer/lightingest) on the system where logs are exported, or install LightIngest on another system that has access to the exported logs. LightIngest supports Windows only. +1. LightIngest supports Windows only. [Install and configure LightIngest](/azure/data-explorer/lightingest) on the Windows system where logs are exported, or install LightIngest on another Windows system that has access to the exported logs. 1. If you don't have an existing ADX cluster, create a new cluster and copy the connection string. Learn how to [set up ADX](/azure/data-explorer/create-cluster-database-portal).-1. In ADX, create tables and define a schema for the CSV or JSON format (for QRadar). Learn how to create a table and define a schema [with sample data](/azure/data-explorer/ingest-sample-data) or [without sample data](/azure/data-explorer/one-click-table). +1. In ADX, create tables and define a schema for the CSV or JSON format (for QRadar). Learn how to [create a table and define a schema using sample data](/azure/data-explorer/ingest-sample-data) or [create a table and define a schema without sample data](/azure/data-explorer/one-click-table). 1. [Run LightIngest](/azure/data-explorer/lightingest#run-lightingest) with the folder path that includes the exported logs as the path, and the ADX connection string as the output. When you run LightIngest, ensure that you provide the target ADX table name, that the argument pattern is set to `*.csv`, and the format is set to `.csv` (or `json` for QRadar). ## Ingest to Azure Blob Storage -To ingest your historical data into Azure Blob Storage (option 3 in the [diagram above](#export-data-from-the-legacy-siem)):+To ingest your historical data into Azure Blob Storage: 1. [Install and configure AzCopy](/azure/storage/common/storage-use-azcopy-v10) on the system to which you exported the logs. Alternatively, install AzCopy on another system that has access to the exported logs. -1. [Create an Azure Blob Storage account](/azure/storage/common/storage-account-create) and copy the authorized [Microsoft Entra ID](/azure/storage/common/storage-use-azcopy-v10#option-1-use-azure-active-directory) credentials or [Shared Access Signature](/azure/storage/common/storage-use-azcopy-v10#option-2-use-a-sas-token) token. +1. [Create an Azure Blob Storage account](/azure/storage/common/storage-account-create) and copy the authorized [Microsoft Entra ID](/azure/storage/common/storage-use-azcopy-v10#option-1-use-azure-active-directory) credentials or [Shared Access Signature](/azure/storage/common/storage-use-azcopy-v10#option-2-use-a-sas-token) token. 1. [Run AzCopy](/azure/storage/common/storage-use-azcopy-v10#run-azcopy) with the folder path that includes the exported logs as the source, and the Azure Blob Storage connection string as the output. <a name="next-steps"></a> ## Next step -Now that you ingested historical data into your target platform, convert your dashboards to workbooks.- > [!div class="nextstepaction"] > [Convert your dashboards to workbooks](migration-convert-dashboards.md)