As digital environments expand, Security Operations teams are often faced with the challenge of optimizing costs while dealing with an exponential increase in data. This article outlines a strategy to reduce data volume and retain important information using Data Collection Rules (DCRs). The authors discuss how to decide what's important in a log for your organization and demonstrate the process of using DCRs to discard unnecessary information from logs. They also caution that only you can decide what’s essential for your organization in a particular log or table.
The authors delve into two types of DCRs: standard and workspace, explaining their use cases. They then guide readers on identifying high-volume sources, determining high-volume tables, record level analysis, column level analysis, and examining the process using two examples – AADNonInteractiveSigninLogs and SecurityEvent. In conclusion, they emphasize that as digital footprints grow exponentially, it is increasingly crucial for security teams to be judiciously intentional about the data they collect and retain. To learn more about this strategy and its application through practical examples, read the full article.
Post generated with the help of Azure OpenAI GPT4
#msftadvocate #Sentinel #AzureSentinel https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/save-money-on-your-sentinel-ingestion-costs-with-data-collection/ba-p/4270256