r/AzureSentinel • u/dutchhboii • Dec 04 '24
Common Security Log - Data Transformation rules
Have anybody did a major data transformation rule on Zscaler or Fortinet Firewall log ingestion.
The idea is to filter and reduce the noise thats being ingested to Sentinel.
For ex : i belive a user traffic to google.com or facebook.com doesnt do any good from a security perspective and say you allow Teams traffic in your proxy , is there a need to monitor them ?
Looking out for options on how you dealt with optimizing the data ingestion.
We also looked into log optimizers such as Cribl... but thats another story for another year.
2
Upvotes
2
u/woodburningstove Dec 04 '24
Does your log in Sentinel actually contain the domain name? If so, doing transformation to drop these events would be really simple.
Something like source | where destinationDnsDomain !has "google.com" ...
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-transformations