Azure Monitor AAD Logs: Reduce log size¶

Disclaimer

By using SPL2 templates for data processing (the “templates”), you understand and agree that templates are provided “as is”. Splunk disclaims any and all warranties, express or implied, including without limitation the implied warranties of merchantability, fitness for a particular purpose and warranties arising out of course of dealing or usage of trade or by statute or in law. Splunk specifically does not warrant that templates will meet your requirements, the operation or output of templates will be error-free, accurate, reliable, complete or uninterrupted.

Use case¶

Use this template to reduce the size of Azure Monitor AAD logs by removing unnecessary fields.

Template details¶

Compatibility¶

This template is compatible with Splunk Add-on for Microsoft Cloud Services v5.5.0.

Template description¶

This pipeline template reduces the size of Azure Monitor ADD events while preserving compatibility with the Splunk Common Information Model (CIM) and Security Detections. This pipeline takes events with a source type azure:monitor:aadand removes the following fields from the events:

durationMs
properties.correlationId
properties.cycleId
properties.durationInMilliseconds
properties.isProcessing
properties.jobId
properties.ssoExtensionVersion

Supported sourcetypes¶

This pipeline template processes events only with the azure:monitor:aad sourcetype. Events with other sourcetypes are passed through without processing. If you’re using Event Hub modular input with event_format_flag set to 1, those AAD events are not supported by this template.

Template outline¶

Template consists of few custom functions followed by a pipeline that uses these functions.

Functions

The following table shows all custom functions:

Function name	Description
`remove_fields`	This function removes unnecessary fields from original event and stores reduced event back to _raw.

Pipeline

This pipeline applies the function to events with the sourcetype azure:monitor:aad and performs a pass-through for all other events.

Configuration instructions¶

If any field listed in template description are present in the event, the remove_fields function deletes all of them. If you don’t want to delete all the fields, you can modify the field names provided in json_delete accordingly.

Configuration example scenario: Do not remove durationMs field from event

Perform the following steps to keep the durationMs field:

In the remove_fields function, remove durationMs from json_delete.
Execute the pipeline preview and confirm that the field is not removed.
Save the changes.