Forum Discussion
Excluding specific events from log analytics agent (Windows)
Hello everyone,
We are in phase of creating a PoC to possibly replace our SIEM. So far I believe we have done a good job presenting capabilities of Sentinel. However, there is one main issue for us right now, which is not being able to find a solution to log noise. We have Log Analytic Agents deployed on our on-prem servers and workstations. Installation was really straight forward and we have chosen the "common" events filter instead of all events. We have tried all events but AppLocker events were too noisy to handle (increasing the cost as well)
However, since we have deployed agents into another network zone, we have seen a single windows event constantly triggering (90% of the log usage is coming from this one event). I have tried looking at the documentation to see if we are able to exclude specific events from being collected but I no luck so far. Although I did see you can do this with agents installed on azure VMs, nothing about on-prem servers.
below is the event we would like to exclude
- Rod_Trent
Microsoft
To filter at the client, you'll need to use the new AMA client.
https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent
For on-prem installations, the system must have Azure Arc installed and enabled.- I believe this only applies to VM's on azure. I was talking about the on-premise servers. I checked your link but all I see is Azure Virtual Machines being mentioned.
- Rod_TrentYes, but if you read deeper, it talks about working for on-premises servers, but Azure Arc is required to be installed. I call it out a bit better at the bottom of my blog post: https://azurecloudai.blog/2021/06/14/how-to-limit-what-azure-sentinel-collects-from-windows-systems/
