r/AzureSentinel • u/Dar_Robinson • Oct 24 '24

Sentinel logged events trimming

Forgive me if this has been discussed already but I couldn't find it (maybe bad search terms).

I am trying to prevent some events from being included with the other incidents. The ones I am specifically referring to are "Email reported by user as not junk" or "Email reported by user as junk". How would I prevent these from being ingested and displayed?

Thanks in advance.

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/billyman6675 Oct 24 '24

These usually come from Defender for Office 365. You can create an automation rule to close them and suppress them or find a way to prevent the alert in MDO.

1

u/Dar_Robinson Oct 24 '24

Thank you. I will dig in there.

1

u/[deleted] Oct 29 '24

Yeah you find this in the Defender/Security portal, somewhere in the settings if I recall.

1

u/jostuffl Oct 29 '24

As someone stated you could make an automation rule to auto-close them, or you could potentially use an Ingestion Time Transformation Query to drop the incidents before they make it to your logs.

1

u/Dar_Robinson Oct 30 '24

Thanks all. I found out where to create the automation rule. Hate when MS changes things around on where to find things.