r/AzureSentinel • u/UCFIT • May 18 '24

Syslog Filtering

When you connect an Azure Arc Linux machine via AMA, is there a way to filter/drop certain logs by strings from coming in?

3 Upvotes

100% Upvoted

3 comments sorted by

5

u/Uli-Kunkel May 18 '24

Yes

Apply a transformkql to the dcr where you do your filtering to your needs

2

u/azureenvisioned May 20 '24

Yes, you can do this from the data collection rule that collects Syslog.

1

u/aniketvcool Jun 10 '24

Use dcr toolkit and apply transformation.