Is there any way to filter the logs by using dcr pipeline before it sends to sentinel. as per the refferance we need to validate the logs and then to remove it which means logs will be ingested to workspace and in production deployment the size of the logs will be enourmous. How ever if the logs from 2 differnt types of firewall is coming under one table and using one dcr then at that time we would need to specify the device vendor as well to get it filterout right.
Request you to please make video on KQL Tutorial in depth please please.
Instead of Rest api, you can also import the DRC into empty Terraform file and then add the transformkql property then terraform apply. Just a trick.
Can I send Prometheus metrics of an application running on my azure VM to the monitor workspace?
Enable Azure Monitor managed service for Prometheus and then the Prometheus metrics can be stored in azure monitor and use promql.
Is there any way to filter the logs by using dcr pipeline before it sends to sentinel. as per the refferance we need to validate the logs and then to remove it which means logs will be ingested to workspace and in production deployment the size of the logs will be enourmous.
How ever if the logs from 2 differnt types of firewall is coming under one table and using one dcr then at that time we would need to specify the device vendor as well to get it filterout right.