Transformkql samples request for standard tables

[Ysuuuuuuuu]

Transformkql samples request for standard tables

[v-muuppugund]

Hi @Ysuuuuuuuu ,Could you please share more details about the issue,What is solution/Connector and in that if parser share parser details with detailed screen shots

[Ysuuuuuuuu]

Hello @v-muuppugund , the solution is similar to https://learn.microsoft.com/en-us/azure/sentinel/connect-logstash-data-connection-rules#create-dcr-resources-for-ingestion-into-a-standard-table.

Part of the logs that will be ingested via logstash are like:

This schema is totally different from the schema of standard table SecurityEvent. Then a proper transformkql is needed in DCR to map the fields in the ingested logs to the fields of SecurityEvent.

[v-muuppugund]

Hi @Ysuuuuuuuu , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 27Mar24. Thanks!

[Ysuuuuuuuu]

Thanks in advance.

[Ysuuuuuuuu]

Hello @v-muuppugund , may I get some updates for this ask? Thanks.

[v-muuppugund]

Hello @v-muuppugund , may I get some updates for this ask? Thanks.

Hi @Ysuuuuuuuu ,Working on further analysis on this issue with Query,will update you

[Ysuuuuuuuu]

Thanks. Look forward to your further updates.

[v-muuppugund]

Hi @Ysuuuuuuuu , Could you please provide couple of time slots for teams meeting on the issue to [email protected] for further troubleshooting.

[v-muuppugund]

Hi @Ysuuuuuuuu ,As discussed over call today got the data,will update you

[v-muuppugund]

Hi @Ysuuuuuuuu ,We are working on it ,will update you ,as we are facing some permissions issue during standard conversion,will let you know if needed we can have a call with customer,will update you

[v-muuppugund]

Hi @Ysuuuuuuuu ,As discussed over teams call today,as per your confirmation as there are no documentation available,we are closing your issue (#10185) as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation