Azure Sentinel Normalization?

Ofer_Shezaf, I will definitely join the preview program.

As for clarification, like i said most of my background have been in traditional SIEMs so forgive me if im missing a concept or something like that, but the idea is that if you have a large amount of data sources (e.g CEF, Security Events, other syslog, audit events) reporting to the platform. You should be able to utilize a standardized information schema to search and correlate across all these log sources. Usually a list of predefined fields like Username,IP Address, Host, and some more are parsed to the same field names, allowing the user whether it be an analyst or content creator to either search across all log sources or create rules that span multiple log sources.

Some vendors even go so far as to classify a "common event" that is a field that will explain what the event means (and is the same for all log sources). I know we can have field aliases or even parse our own fields quite easily however the management and manual effort required to keep this up to date is a lot.

Hope this makes sense, let me know if i need to clarify further.

- Ajay J

Ofer_Shezaf 

I will definitely sign up for the preview!

As for clarification, like I said above my experience lies mostly with traditional SIEM technologies where we have a large amount of log sources reporting into a platform. These log sources are then mapped to a common information schema/format where we can search one field (e.g username) and that field is translated to all the username fields of each log sources, effectively giving the analyst the ability to query across multiple log sources using a common information schema.

I do know that there is the possibility of aliases or even parsing into new fields is quite easy with sentinel, however the manual work and maintenance required to keep this up to date makes it really tough to achieve.

So essentially, we are looking for a common information schema which allows users to query across multiple log sources easily. I should also add, my perspective on this is also from a service provider(MSSP) and while we may be able to build out the aliases or fields required for one customer, if we are trying to use sentinel for multiple customers you can probably see the amount of effort required to get this standardized set of fields on all customers. Not to mention the other main issue which is the training we need to give all analysts if we dont have a standardized set of fields.

Hope this makes sense, and let me know if im missing a concept of sentinel or a feature 🙂