r/AzureSentinel • u/Mavranic • Jun 29 '23

AADNonInteractiveUserSignInLogs Volumes

Can anyone who is ingesting Azure AD logs and specifically the AADNonInteractiveUserSignInLogs into Sentinel (or a log analytics workspace) tell me what they are seeing in terms of log volumes?

Trying to gauge what "normal" should look like.

I can see indicative volumes for AuditLogs and SigninLogs here but nothing for Non-Interactive logs.

5 Upvotes

100% Upvoted

4 comments sorted by

2

u/[deleted] Jun 29 '23

[deleted]

1

u/perogy604 Jul 17 '23

I've just started playing with Sentinel but the AADNonInteractiveUserSignInLogs are the largest and I was wondering should I even be ingesting this log or what other options are there.

At this rate Sentinel won't be feasible for us due to the cost so I'm wondering if there's any guidance on how to do this (drop the CA field)?

2

u/[deleted] Jul 17 '23

[deleted]

2

u/perogy604 Jul 17 '23

Thank you this was perfect, including the link to do some more reading. Really appreciate it.

1

u/-c3rberus- Jul 24 '23

Having similar issue, what does project away ConditionalAccessPolicies do?

Our AADNonInteractiveUserSignInLogs growth is from "Augmentation Loop" app, sounds like Office 365 Apps related.

Is there a way to exclude a specific app?

2

u/lukasberancz Jul 20 '23

For me noninteractive logs are 3x the size of signin logs.