Ingestion of Security Events

Question

Good afternoon,

Was not sure if anyone else has seen this before. We have a few clients that are getting abnormal ingestion of security events coming from the DC. Event ID 4661 in this case. We don't want to disable the event as it is important but we do not want azure to ingest this event as it drives up costs dramatically. Does anyone know of a way to disable ingestion for just a certain event?

Thank you!

Answer 1

Hello Eugene,

Thanks for your question.

You can pick a granular auditing by using “Advance Audit Policy – Audit Object Access”.

You can stop Audit logging for SAM task category by using the below command:

auditpol /set /subcategory:"SAM" /success:disable /failure:disable

See:

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events

Regards,

You can mark it 'Accept Answer' if this helped.