Forum Discussion
Solved
What Logs To Monitor For Initial Sentinel Onboard
Does anyone have any recommendation what logs to monitor or best practices once Sentinel is enabled then what events we should focus on? Currently working on pricing but as we are sending logs from our own syslog server but then I want to filter it out from there & only send the logs to Sentinel which I think will be useful (source can be anything endpoint, dns, windows security events etc) so based on that volume we can estimate the cost. Is there any documentation I can follow?
Any suggestion would be appreciated.
- I would start with the free connectors first -
- Azure Active Directory Identity Protection - Alerts
- Azure Activity
- Azure Defender - Alerts
- Microsoft Cloud App Security - Alerts
- Microsoft Defender for Endpoint - Alerts
- Microsoft Defender for Office - Alerts
- Office 365 Activity - Admin and audit logs (SharePoint, Exchange, OneDrive, Teams)
If you use the paid connectors next, use this query to keep track and stay under budget:
//Billable data volume by data type
Usage
| where TimeGenerated > ago(32d)
| where StartTime >= startofday(ago(31d)) and EndTime < startofday(now())
| where IsBillable == true
| summarize BillableDataGB = sum(Quantity) / 1000. by bin(StartTime, 1d), DataType | render barchart
2 Replies
- John_Barbare
Microsoft
I would start with the free connectors first -
- Azure Active Directory Identity Protection - Alerts
- Azure Activity
- Azure Defender - Alerts
- Microsoft Cloud App Security - Alerts
- Microsoft Defender for Endpoint - Alerts
- Microsoft Defender for Office - Alerts
- Office 365 Activity - Admin and audit logs (SharePoint, Exchange, OneDrive, Teams)
If you use the paid connectors next, use this query to keep track and stay under budget:
//Billable data volume by data type
Usage
| where TimeGenerated > ago(32d)
| where StartTime >= startofday(ago(31d)) and EndTime < startofday(now())
| where IsBillable == true
| summarize BillableDataGB = sum(Quantity) / 1000. by bin(StartTime, 1d), DataType | render barchart - It all depends on what systems you have, but here are some good ones Azure Active Directory Identity Protection
Azure Active Directory
Azure Activity
Azure DDoS Protection
Azure Defender
Azure Firewall
Azure Information Protection (Preview)
Azure Key Vault
Azure Kubernetes Service (AKS)
Azure SQL Databases
Azure Storage Account (Preview)
Microsoft 365 Defender (Preview)
Microsoft Cloud App Security
Microsoft Defender for Endpoint
Microsoft Defender for Identity (Preview)
Microsoft Defender for Office 365 (Preview)
Office 365
Security Events
Threat intelligence - TAXII (Preview)
Threat Intelligence Platforms (Preview)
