how to use data transformation on the SecurityEvent table in Sentinel to drop events

David Broggy 5,716 MVP

Hi there,

I'd like to use a data transformation to filter some events entering Sentinel.

The test I'm doing is with the SecurityEvent table.

I added this transformation:

source| where EventID <> 4688

However after waiting an hour I'm still seeing 4688 events in the SecurityEvent table.

Can someone tell me if this works or if I'm doing something wrong?

Thanks!

David Broggy 5,716 Reputation points MVP

2024-08-27T19:08:37.32+00:00

Hey @Clive Watson any insight on this?
Givary-MSFT 32,321 Reputation points Microsoft Employee

2024-08-28T08:35:09.6733333+00:00

@David Broggy Thank you for reaching out to us, refer to last example mentioned in this table see if it helps to achieve your ask of filtering event 4688 from entering Sentinel.

Let me know if you have any questions, feel free to post back.

Your answer