For our MSSP SOC service we use Azure Sentinel and have onboarded all our on-premises machines to LogAnalytics with the AMA. When we investigate behaviour from workstations and find suspicious behaviour, we often like to provide granular information about this workstation. It would be desirable to add a local source address for the specific machine. However, in Azure Sentinel we'd only see the outbound addresses from the premises in our logging.
Is there a way for us to deduct/find the local addresses of machines which have an Azure Agent or would we have to onboard additional events?
