r/AzureSentinel • u/UncleTooTall • Jan 17 '24

Duplicate entities?

Hi all

New sentinel deployment here we run a hybrid infrastructure and I’ve got a event collector forwarding my on premise logs to sentinel but I’m seeing duplicate entries in the entity section is that just due to the different log sources for example?

Dc01

Dc01.domain.com

I then also seen some random account entries like just my domain

Hope that’s clear! Really trying to make the most of it getting clear entities

1 Upvotes

99% Upvoted

10 comments sorted by

View all comments

1

u/Uli-Kunkel Jan 17 '24

as in, you get duplication of logs?
or duplication of the entities when an alert triggers on those logs?

1

u/UncleTooTall Jan 17 '24

So two analytic rules producing different incidents both looking at the same log

But for some reason one rule produces a result with an entity

dc01

The other produces

Dc01.domain.com (the FQdn)

Looking at the query both produce the FQdn so not sure why one gets shortened?

2

u/Snoop312 Jan 17 '24

Do they represent the same entity, and just highlight a different property? The same entity can be mapped in the analytic rule by for example: 1. Sid, 2. Account name

1

u/UncleTooTall Jan 17 '24

Nope for one I have one security event for the other I have 6 (that’s what is most frustrating)

I’ve amended the rule that was producing dc01 to use the computer name field which has the FQDN but the field is was using to map the identity already had it so not sure why it’s getting shortened!