Hey everyone,

I have a list of 10 KQL queries that I use for log source decertification in Microsoft Sentinel. Right now, I have to go into Sentinel, run each query manually, fetch the results, take screenshots of the graphs (like ingestion patterns over the last month), and store them as evidence.

What I’d like to do instead is have a solution that: •Runs all 10 KQL queries automatically, say once a month •Saves the results (including visualizations or graphs if possible) •Stores them somewhere accessible, like in a Storage Account, SharePoint, or a report file

I already have the KQLs ready. What’s the best way to automate this in Azure? Can I do it using Logic Apps, Azure Functions, or maybe Power Automate with Sentinel API? I already have workbook implemented but I don’t want to use workbook because it does not provide the desired output!

Looking for a clean, repeatable approach that doesn’t require manual intervention each month.

Thanks in advance!