Forum Discussion

securityxpert1122's avatar
securityxpert1122
Copper Contributor
Aug 18, 2023

Log forwarder sending duplicate logs

I have two log forwarders sending logs to Sentinel. One is logstash and other one is Azure log forwarder I setup on Ubuntu.  Since logstash was sending logs to commonsecuritylogs_CL table and those ...
KQL
Log Data
siem
soar
Usama_Saleem's avatar
Usama_Saleem
Brass Contributor
Aug 21, 2023
Run the following KQL query to get the list of log forwarders (set the timeframe according to you need)

CommonSecurityLog
| distinct DeviceVendor