how to use data transformation on the SecurityEvent table in Sentinel to drop events

Question

David Broggy 6,291 MVP Volunteer Moderator

Hi there,

I'd like to use a data transformation to filter some events entering Sentinel.

The test I'm doing is with the SecurityEvent table.

I added this transformation:

source| where EventID <> 4688

However after waiting an hour I'm still seeing 4688 events in the SecurityEvent table.

Can someone tell me if this works or if I'm doing something wrong?

Thanks!

David Broggy 6,291 Reputation points MVP Volunteer Moderator

2024-08-27T19:08:37.32+00:00

Hey @Clive Watson any insight on this?
Givary-MSFT 35,621 Reputation points Microsoft Employee Moderator

2024-08-28T08:35:09.6733333+00:00

@David Broggy Thank you for reaching out to us, refer to last example mentioned in this table see if it helps to achieve your ask of filtering event 4688 from entering Sentinel.

Let me know if you have any questions, feel free to post back.
Sándor Tőkési 271 Reputation points

2024-12-08T12:46:50.1966667+00:00

@David Broggy if you want to drop the logs via a transformKQL I would heavily recommend type casting the values - I encountered lots of errors and unwanted behaviors without type casting.

So, it could be

source | where tostring(EventID) != '4688'

Your answer

David Broggy 6,291 Reputation points MVP Volunteer Moderator

2024-08-27T19:08:37.32+00:00

Hey @Clive Watson any insight on this?
Givary-MSFT 35,621 Reputation points Microsoft Employee Moderator

2024-08-28T08:35:09.6733333+00:00

@David Broggy Thank you for reaching out to us, refer to last example mentioned in this table see if it helps to achieve your ask of filtering event 4688 from entering Sentinel.

Let me know if you have any questions, feel free to post back.
Sándor Tőkési 271 Reputation points

2024-12-08T12:46:50.1966667+00:00

@David Broggy if you want to drop the logs via a transformKQL I would heavily recommend type casting the values - I encountered lots of errors and unwanted behaviors without type casting.

So, it could be

source | where tostring(EventID) != '4688'