How to segregrate data inside Sentinel ?

Question

We have logstash sending all different logs to one custom table( created in output conf file in logstash) in Sentinel

Note:
We are not considering to create filters in logstash end and then define output file in logstash to send to different tables in Sentinel.

Is there any way I can do it into Sentinel ?
i.e, is there any way to create separate tables inside Sentinel ( like we can do in ADX) and then based on functions defined it will send it to different(custom tables ) tables created in Sentinel ?

What's the best way to achieve the goal of segregation of logs .

Answer 1

You can create and save user-functions to parse the table for your various needs. Sort of like a view in SQL. The functions are called and treated like a table. This eliminates the need for secondary processing and the additional data ingestion of a Function App parser. https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-kql-functions-to-speed-up-analysis-in-azure-sentinel/ba-p/712381

The downside of using logstash is that much of Sentinel's functionality is based on the built-in connectors and tables. Bringing data into a CL requires custom alert rules and workbooks (or modification of the provided templates). Advanced features like threat intelligence and UEBA may also be difficult or impossible to use with CL data. Best to use the built-in options and you are making a lot of unnecessary work for yourself using logstash as a primary collection method.