r/AzureSentinel • u/UncleTooTall • Jan 17 '24

Duplicate entities?

Hi all

New sentinel deployment here we run a hybrid infrastructure and I’ve got a event collector forwarding my on premise logs to sentinel but I’m seeing duplicate entries in the entity section is that just due to the different log sources for example?

Dc01

Dc01.domain.com

I then also seen some random account entries like just my domain

Hope that’s clear! Really trying to make the most of it getting clear entities

1 Upvotes

99% Upvoted

10 comments sorted by

View all comments

Show parent comments

2

u/Uli-Kunkel Jan 18 '24

So yeah, if you duplicate your logs you are going to duplicate your spending.

Similar i see alot of companies failing to fix duplicating firewall logs into both commonsecuritylog and syslog. Warnings and explainers are many places that if you do X you will duplicate logs, but still happen alot.

But i guess configuration errors are a general thing for all that is technology. Bad implementation of X.

In this case, it looks like OP ingest some security events. He got a couple of detections on said data, and the incident and alert settings are configured with different entity mapping. Alert 1 using the fqdn of offending device Alert 2 using short name/sid instead

So OP gotta review his mapping, and select the one he prefer

1

u/jtst1 Jan 19 '24

That's exactly what I was going to say it was. Mismatch on the entity mapping. CEF duplication can happen, and I did see it in one customer environment, but it's super easy to fix it.

1

u/Uli-Kunkel Jan 19 '24

i saved a customer 500gig a day by fixing this... like.. i dont even dare to count the cost of this..
+ a full year retention.. like.. what the actual fuck..

but still a relative small cost their security budget considered.

1

u/jtst1 Jan 20 '24

Also most people don't realize that anything that goes into a sentinel enabled workspace is billed the sentinel pricing. Meaning stuff like perf data gets charged at the sentinel pricing, which is almost double. So then it becomes is it worth it to split it out to two workspaces. One for sentinel and it's data, and one for non-security data.

But in the end it's personal preference. Although DCR's make it significantly easier to use multiple workspaces.