I have a couple of questions around DCR's and ASIM.

I know that you can only do ingestion time transformation on azure tables straight from the log analytics workspace.

I have read that you are able to use DCR's for transformations on custom tables within azure. For example, i have just connected the SAP BTP data connector and created a DCR/DCE for this. Ideally there are logs in there that i want to project-away.

I have read the documentation that is outlined here, and know how to apply the transformation.

I have also read that you are able to convert custom logs to ASIM here

It would be good if i could have a standardised schema across all tables (Azure and Custom) whilst dropping logs using DCR's.

Is this what the documentation is suggesting here, has anyone had any real experience with this solution and what do you think.

Hey all, I'm a security engineer working on a personal project and I am trying to find out if others have the same pain points as I do when working with Sentinel.

It is a great tool, and I have been working with it for around 6 years now, but recently I am finding things a bit... 'old'.

I would love to hear about your daily struggles, and what you think makes it (sometimes) hard to work with. Any specific examples would be a huge help!

--edit--

I have changed the years from 8 to 6 as i mistyped in my original post