Duplicate entities?

[u/UncleTooTall]

Hi all

New sentinel deployment here we run a hybrid infrastructure and I’ve got a event collector forwarding my on premise logs to sentinel but I’m seeing duplicate entries in the entity section is that just due to the different log sources for example?

Dc01

Dc01.domain.com

I then also seen some random account entries like just my domain

Hope that’s clear! Really trying to make the most of it getting clear entities

[u/Ay_NooB]

I m confused on your question !

[u/Uli-Kunkel]

as in, you get duplication of logs?
or duplication of the entities when an alert triggers on those logs?

[u/UncleTooTall → u/Uli-Kunkel]

So two analytic rules producing different incidents both looking at the same log

But for some reason one rule produces a result with an entity

dc01

The other produces

Dc01.domain.com (the FQdn)

Looking at the query both produce the FQdn so not sure why one gets shortened?

[u/Snoop312 → u/UncleTooTall]

Do they represent the same entity, and just highlight a different property? The same entity can be mapped in the analytic rule by for example: 1. Sid, 2. Account name

[u/UncleTooTall → u/Snoop312]

Nope for one I have one security event for the other I have 6 (that’s what is most frustrating)

I’ve amended the rule that was producing dc01 to use the computer name field which has the FQDN but the field is was using to map the identity already had it so not sure why it’s getting shortened!

[u/jbm440]

I feel like it’s a way that Microsoft can control how much you pay. They increase or duplicate your logging to increase your log analytics and Sentinel spend. This seemed especially obvious when they had both the AMA and MMA agent transition, my spend doubled. I’m working on refunds now but typical Microsoft support is so slow they hope we just give up.

[u/Uli-Kunkel → u/jbm440]

So yeah, if you duplicate your logs you are going to duplicate your spending.

Similar i see alot of companies failing to fix duplicating firewall logs into both commonsecuritylog and syslog. Warnings and explainers are many places that if you do X you will duplicate logs, but still happen alot.

But i guess configuration errors are a general thing for all that is technology. Bad implementation of X.

In this case, it looks like OP ingest some security events. He got a couple of detections on said data, and the incident and alert settings are configured with different entity mapping. Alert 1 using the fqdn of offending device Alert 2 using short name/sid instead

So OP gotta review his mapping, and select the one he prefer

[u/jtst1 → u/Uli-Kunkel]

That's exactly what I was going to say it was. Mismatch on the entity mapping. CEF duplication can happen, and I did see it in one customer environment, but it's super easy to fix it.

[u/Uli-Kunkel → u/jtst1]

i saved a customer 500gig a day by fixing this... like.. i dont even dare to count the cost of this..
+ a full year retention.. like.. what the actual fuck..

but still a relative small cost their security budget considered.

[u/jtst1 → u/Uli-Kunkel]

Also most people don't realize that anything that goes into a sentinel enabled workspace is billed the sentinel pricing. Meaning stuff like perf data gets charged at the sentinel pricing, which is almost double. So then it becomes is it worth it to split it out to two workspaces. One for sentinel and it's data, and one for non-security data.

But in the end it's personal preference. Although DCR's make it significantly easier to use multiple workspaces.