Transform data with filter and split features (Preview)
Analysis / inference: Microsoft Sentinel introduced preview features for filtering and splitting data natively in the Microsoft Defender portal to help optimize log ingestion costs and reduce noise.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Native filtering and splitting capabilities have been introduced in preview for Microsoft Sentinel via the Microsoft Defender portal, enabling pre-ingestion data control.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisNative data transformation capabilities directly address SIEM ingestion costs and noise reduction by allowing security teams to filter and split logs prior to full ingestion into Microsoft Sentinel.
Provides security engineers with direct tools to lower data storage fees and streamline security analytics processing by dropping or redirecting unnecessary logs.
Section 03 · Recommended actions
- Evaluate preview availability in your Microsoft Defender portal environment.
- Identify high-volume, low-value log sources that can leverage the new filter and split capabilities.
- Review current ingestion volume rules and data connectors in the Microsoft Defender portal to identify noisy logs suitable for pre-ingestion filtering.
- Assess routing configurations between analytics and data lake tiers for optimized cost management.