Integration with Microsoft Sentinel

[BeaconBits]

Hello everyone,

I'm sending logs to MS Sentinel.

To do this I ran a command on Checkpoint Management Server:

cp_log_export add name <server-name> target-server <server-IP> target-port 514 protocol tcp format cef
cp_log_export restart
cp_log_export status

I can see logs are being received in the MS sentinel through the proxy server that is <server-IP>.

But I see huge logs are coming into MS Sentinel and it is increasing our cost in Azure.

The Log Exporter document is telling about field restriction Log Exporter - Check Point Log Export

How can we optimise this?

Real example would be appreciated.

Thanks!

B