Creating extra field based on an existing one

%3CLINGO-SUB%20id%3D%22lingo-sub-1038419%22%20slang%3D%22en-US%22%3ECreating%20extra%20field%20based%20on%20an%20existing%20one%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1038419%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20folks%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERight%20after%20logs%20are%20ingested%20to%20Azure%20Sentinel%2C%20i%20need%20to%20add%20an%20additional%20key%2Fvalue%20pair%20to%20the%20schema%26nbsp%3B%20and%20get%20it%20populated%20for%20every%20log%20based%20on%20the%20value%20of%20a%20specific%20existing%20key.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20example%2C%20all%20logs%20should%20have%20a%20new%20field%20named%20Country.%20If%20the%20value%20of%20Tenant%20ID%20in%20the%20ingested%20logs%20%3D%20xyz%2C%20then%20the%20Country%20field%20should%20be%20populated%20as%20United%20Stated%2C%20and%20so%20on.%20So%20i%20have%20pre-known%20TenantID%20-%20Country%20mappings%2C%20and%20i%20would%20like%20to%20insert%20the%20country%20values%20in%20all%20logs.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20other%20SIEM%20solutions%20such%20requirement%20can%20be%20done%20by%20using%20%22feeds%22.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20ideas%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1038419%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESentinel%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1063743%22%20slang%3D%22en-US%22%3ERe%3A%20Creating%20extra%20field%20based%20on%20an%20existing%20one%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1063743%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F469462%22%20target%3D%22_blank%22%3E%40majo1%3C%2FA%3E%26nbsp%3B%3A%20to%20simulate%20other%20SIEMs%20and%20add%20a%20physical%20field%2C%20you%20will%20have%20to%20use%20Logstash%20for%20ingestion%20(see%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FAzure-Sentinel-Creating-Custom-Connectors%2Fba-p%2F864060%22%20target%3D%22_self%22%3Ehere%3C%2FA%3E).%20However%20the%20Sentinel%20way%20would%20be%20to%20reference%20the%20data%20using%20for%20example%20%3CA%20href%3D%22https%3A%2F%2Fcloudblogs.microsoft.com%2Findustry-blog%2Fen-gb%2Fcross-industry%2F2019%2F08%2F13%2Fazure-log-analytics-how-to-read-a-file%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Eexternaldata%3C%2FA%3E%20or%20a%20Sentinel%20table%20ingested%20using%20a%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FAzure-Sentinel-Creating-Custom-Connectors%2Fba-p%2F864060%22%20target%3D%22_self%22%3Ecustom%20connector%3C%2FA%3E.%20While%20you%20will%20not%20physically%20create%20a%20new%20field%2C%20you%20can%20enrich%20as%20part%20of%20a%20query%2C%20or%20if%20you%20want%20a%20%22virtual%22%20field%2C%20use%20a%20%22view%22%20function%20that%20will%20add%20the%20field%20on%20top%20of%20the%20original%20event.%20We%20are%20going%20to%20write%20a%20series%20of%20blogs%20on%20some%20of%20those%20techniques%20in%20the%20coming%20weeks.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hello folks,

 

Right after logs are ingested to Azure Sentinel, i need to add an additional key/value pair to the schema  and get it populated for every log based on the value of a specific existing key.

 

For example, all logs should have a new field named Country. If the value of Tenant ID in the ingested logs = xyz, then the Country field should be populated as United Stated, and so on. So i have pre-known TenantID - Country mappings, and i would like to insert the country values in all logs.

 

In other SIEM solutions such requirement can be done by using "feeds".

 

Any ideas ?

 

 

 

 

1 Reply
Highlighted

@majo1 : to simulate other SIEMs and add a physical field, you will have to use Logstash for ingestion (see here). However the Sentinel way would be to reference the data using for example externaldata or a Sentinel table ingested using a custom connector. While you will not physically create a new field, you can enrich as part of a query, or if you want a "virtual" field, use a "view" function that will add the field on top of the original event. We are going to write a series of blogs on some of those techniques in the coming weeks.