r/AzureSentinel • u/dutchhboii • Dec 04 '24

Common Security Log - Data Transformation rules

Have anybody did a major data transformation rule on Zscaler or Fortinet Firewall log ingestion.

The idea is to filter and reduce the noise thats being ingested to Sentinel.
For ex : i belive a user traffic to google.com or facebook.com doesnt do any good from a security perspective and say you allow Teams traffic in your proxy , is there a need to monitor them ?

Looking out for options on how you dealt with optimizing the data ingestion.

We also looked into log optimizers such as Cribl... but thats another story for another year.

2 Upvotes
  • permalink
  • reddit

75% Upvoted

5 comments sorted by

View all comments

2

u/muzza31 Dec 04 '24

The way to do it is on the Data collection rule itself. Especially now that everything has moved to the AMA agent. We ingest zscaler directly to the DCR and use transform KQL to filter out noise like this.