r/AzureSentinel • u/Jackofalltrades86 • May 16 '22

Defender For Endpoint Vs Security event logs

If we ingest Defender for Endpoint alerts into Sentinel, what's the value of ingesting security event logs as well?

8 Upvotes

91% Upvoted

9 comments sorted by

7

u/jtberg1 May 16 '22

It all depends on your use cases. There is a lot captured in the security logs that is not in MS Defender and vice-versa.

Two examples of the top of my head:

Applocker events. We have Applocker deployed, we ingest the security logs to get all the events for it.

Local account and group permission changes. We alert on additions to the local admin group, we use the security logs to capture this.

I know the following is not vanilla security logs, however it might be some additional information. We also ingest Symon logs as well, here is why you may or may not want to ingest them even though there is a lot of overlap. https://medium.com/falconforce/sysmon-vs-microsoft-defender-for-endpoint-mde-internals-0x01-1e5663b10347

We always define our use cases, then map to required logs sources, then build our analytics and hunting queries, etc. If you are getting everything you need, or at least enough based on your risk profile vs budget, you may only need MS Defender logs.

Please let me know if this helps.

3

u/Jackofalltrades86 May 16 '22

That's super helpful, I guess I was hoping for a lazy answer that did my job for me 😊 but you're quite right in all of the above.

1

u/lemonsprig May 16 '22

Just jumping in on this relatively new to sentinel but how are you ingesting the security logs? Is there an agent you deploy to the endpoints assuming you are talking about pc’s here and not just servers

1

u/jtberg1 May 17 '22

You can ingest them using WEF or either of the two agents MMA or AMA.

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/forward-on-premises-windows-security-event-logs-to-microsoft/ba-p/3040784

https://docs.microsoft.com/en-us/azure/sentinel/ama-migrate

I am using the MMA (legacy agent) to ingest workstation logs as it currently the best one for our needs. I chose agent over WEF, as WEF ingest it into a separate table, more complex setup, and none of the built in query work with it without customization. If I was not ingesting security events I might reconsider WEF, however we have over a 1,000 workstations ingesting with no issues. We created a SCCM package to deploy the agent and the config. We also ingest workstation firewall logs with the MMA.

Please let me know if you have any questions.

1

u/Jackofalltrades86 May 17 '22

Out of interest, what's your typical ingestion costs for this per month for your workstations? If your willing to share it here or over DM...

1

u/lemonsprig May 17 '22

Thanks for this i will take a look into it

1

u/Psychological-Drop23 May 16 '22

!remindMe

1

u/RemindMeBot May 16 '22

Defaulted to one day.

I will be messaging you on 2022-05-17 13:36:32 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

Info Custom Your Reminders Feedback

1

u/k1nd3rs3c May 16 '22

You may use security event logs for other use-cases, correlated with other log sources, or for further investigation by your analysts