Azure-Sentinel/Tools/Transformations-Library

Microsoft Sentinel Transformations Library

This repository contains samples for multiple scenarios that are possible thanks to the new Log Analytics Custom Logs v2 and pipeline transformation features.

Filtering

Ingestion time transformation allows you to drop specific fields from events or even full evets that you don't need to have in the workspace.

1. Dropping fields
2. Dropping entire records
3. Multiple workspaces for independent entities

Enrichment/Tagging

Adding additional context to an event can greatly help analysts in their scoping and investigation process.

1. Enriching an event or a field in the event with additional meaningful information
2. Translating a value into a customer’s business related value (Geo, Departments,…)

PII Masking/Obfuscation

Another scenario is obfuscation or masking of PII information. This can be Social Security Numbers, email addresses, phone numbers, etc.

1. Masking last 4 digits of SSN
2. Removing email addresses