Forum Discussion

FahadAhmed's avatar
FahadAhmed
Brass Contributor
Jul 28, 2023

Best practice to deal with Excessive Logoff and Logon events

Hi,

Currently we are facing a situation where there are excessive Logon and Logoff events in Microsoft sentinel in the SecurityEvent table, causing high monthly costs.

 

Can you please let me know whats the best practice to deal with them, we dont want to drop them entirely as they may be used in Analytical rules or are required for forensics. 

 

Another option that I saw was to use API tranformation to split the logs and store analytica data in analytical table and forward the other data to basic table. First, if I send the data directly to basic table then it wont be used in Analytical rules (Correct me if I am wrong?). Secondly, I dont know if we can do this through DCR, since I dont know where and how to run that API transformation.

 

Any help will be appreciated.

 

Thanks

data collection

3 Replies

  • raphaelcustodiosoares's avatar
    raphaelcustodiosoares
    Iron Contributor
    Aug 02, 2023
    1) Data is not available for analytic rules or log alerts
    https://koosg.medium.com/use-sentinel-basic-and-archive-logs-fae3bb3a6299

    2) the events of login and logoff, what connector is used in the sentinel for ingest ?
    do you use Azure Monitor Agent ?


    • FahadAhmed's avatar
      FahadAhmed
      Brass Contributor
      Aug 04, 2023
      Logon m log off messages r in SecuirtyEvent table no ingested through MMA agent
      • raphaelcustodiosoares's avatar
        raphaelcustodiosoares
        Iron Contributor
        Aug 04, 2023

        Standard DCRs, currently supported only for AMA-based connectors and workflows using the new Logs ingestion API.
        https://learn.microsoft.com/en-us/azure/sentinel/data-transformation

        The Logs Ingestion API can send data to the following Azure tables. Other tables may be added to this list as support for them is implemented.

        - CommonSecurityLog
        - SecurityEvents
        - Syslog
        - WindowsEvents
        https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview


        Use SecurityEvents table.