Microsoft Entra ID Entity Analytics vs Azure

[erikg]

Hello,

I been leveraging Azure Logs - Audit Logs to collect Azure AD data.
This is have been alright but I wanted to test out the Microsoft Entra ID Entity Analytics, wondering if others' experience with the latter integration.

[willemdh]

Hello,

W've been using it and it's awesome for a lot of reasons.

Something you need to be aware of, is the different timestamps. Depending on the dataview you create the data can visualise in total different ways, because it takes the ingest timestamp vs the asset created timestamp vs the asset last signin timestamp.

There is definitely room for improvement. Some examples:

• I was hoping we could use this data to enrich other datasets which only contains the user id and not the user name. But to achieve that, a transform needs to be added and an enrich index. Imho this should have come out of the box.

Get user.name from user.id in Entity Analytics Azure Entra ID dataset

I guess it doesnt work on datastreams. Is there a builtin way to schedule it? So that it contains the most recent entra id user info? I'm not exactly sure but I would probably start by looking at making a transform on your data stream to a summarized index and then using that summarized index as the source for your enrich policy

• The host.name field is not lowercase fqdn. So I had to add a custom ingest pipeline which lowercases the host.name and append our domain. That way we can correlate with other datasets which contain lowercase fqdn.

Lowercase host.name FQDN Beta Fleet policy setting

Hello, We are working through an effort to make sure host.name is indexed as lowercase fqdn everywhere. We put the original hostname in host.hostname. Considering we have multiple domains, this is not only necessary to avoid host collision problems, but it also allows us to correlate host datasets with network datasets. We have 200+ datasets and some of them are logging camelcase, other uppercase, others lowercase, so there is also a requirement to lowercase the host.name everywhere. [image] …

• It only contains Entra ID devices, not Intune data. Hopefully Elastic will release an Intune Entity Analyticvs dataset soon.

• What we kind of need is an easy! way to compare datasets. I'm having a hard time to compare the Entra ID Device dataset with other datasets, so we can detect, for example, which hosts are missing a certain agent.

WillemD

[erikg]

Thanks!
Yeah I don't like how the Microsoft hides information, we had a similar issue with subscriptions only showing up as subscription.id which didn't help that much until we enriched it using an ingest pipeline.