Forum Discussion

Copper Contributor

May 19, 2022

Solved

Sentinel mask or remove specific sensitive data field

Hi everyone, I am using Office 365 data collector. This collector will collect Exchange Log from O365. The exchange log will include the email subject and it may contain some sensitive data. Can Sen...

Log Data

TDPan1
May 31, 2022
CyrilChu

Based on my understanding,
The process just like ETL
(1,Extract) Sources System (e.g. Exchange Online) -> (2,Transform) Data collection rules -> (3,Load) Sentinel Workspace

If mask or remove sensitive data before load to workspace required, it need done in (2,Transform) state, please apply KQL in Data collection rules to do that.

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/microsoft-sentinel-support-for-ingestion-time-data/ba-p/3244531

Pan DT

CyrilChu

Copper Contributor

May 19, 2022

Thanks for your help, the "project-away" operator can hide the Subject column when search time.
Is any method to mask or remove specific sensitive data fields on the raw log base?

mikhailf

Iron Contributor

May 19, 2022

Do you want to remove the sensitive data from the Log Analytics workspace itself?