This repository contains samples for multiple scenarios that are possible thanks to the new Log Analytics Custom Logs v2 and pipeline transformation features.
Ingestion time transformation allows you to drop specific fields from events or even full evets that you don't need to have in the workspace.
Adding additional context to an event can greatly help analysts in their scoping and investigation process.
- Enriching an event or a field in the event with additional meaningful information
- Translating a value into a customer’s business related value (Geo, Departments,…)
Another scenario is obfuscation or masking of PII information. This can be Social Security Numbers, email addresses, phone numbers, etc.
Among other enhancements, the new custom logs API allows you to ingest custom data into some Microsoft tables: SecurityEvent, WindowsEvent, CommonSecurityLog and Syslog. We have also updated the Microsoft Sentinel Logastash plugin to work with the new API.