{"id":1433,"date":"2023-04-02T17:03:14","date_gmt":"2023-04-02T16:03:14","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=1433"},"modified":"2023-04-13T20:51:40","modified_gmt":"2023-04-13T19:51:40","slug":"understanding-azure-logging-capabilities-in-depth","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=1433","title":{"rendered":"Understanding Azure logging capabilities in depth"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Azure includes lots of great technologies, which can be used for logging purpose. Currently, Microsoft is transitioning from v1-method (MMA) to v2-method using DCRs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This article touches on understanding the main difference between the legacy method (v1-MMA) and the new DCR-method (v2). I am already a big fan of DCRs, check out why ?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This blog also gives a high-level overview of <strong>options<\/strong>, structured in<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data-In (sources)<\/li>\n\n\n\n<li>Data-Transformation<\/li>\n\n\n\n<li>Data-Out<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Furthermore the article also covers details on <strong>deprecation path<\/strong> of v1 technologies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This blog-post is part of a series of blog posts to <a href=\"https:\/\/mortenknudsen.net\/?p=1687\" target=\"_blank\" rel=\"noreferrer noopener\">master Azure logging in depth (overview)<\/a>. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized is-style-default\"><a href=\"https:\/\/mortenknudsen.net\/?p=1687\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25.png\" alt=\"\" class=\"wp-image-2124\" width=\"434\" height=\"502\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25.png 867w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25-259x300.png 259w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25-768x889.png 768w\" sizes=\"auto, (max-width: 434px) 100vw, 434px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get you started, you can find <a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibrary\" target=\"_blank\" rel=\"noreferrer noopener\">ARM-templates &amp; scripts in my AzureLogLibrary (github)<\/a>. Details will be covered in the articles.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibarary\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-1024x466.png\" alt=\"\" class=\"wp-image-2125\" width=\"400\" height=\"182\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-1024x466.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-300x137.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-768x349.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26.png 1057w\" sizes=\"auto, (max-width: 400px) 100vw, 400px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Quick Links<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"#technology-overview\">Technology overview<\/a><br><a href=\"#difference\">What is the change in architecture between v1 (MMA) and v2 (DCR)?<\/a><br><a href=\"#data-in-sources\">Data-in<\/a><br><a href=\"#Data-transformation\">Data-transformation<\/a><br><a href=\"#support-transformation\">Supported ways of doing data transformation<\/a><br><a href=\"#xpath\">Transformation using XPath<\/a><br><a href=\"#transform-pipeline-dcr\">Transformation with Azure Monitor Agent (AMA) &amp; Azure Data Collection Rules (DCR)<\/a><br><a href=\"#transform-logapi\">Transformation with Azure DCR-pipeline (Log Ingestion API) &amp; Azure Data Collection Rule (DCR)<\/a><br><a href=\"#transform-workspace\">Transformation with Azure LogAnalytics Workspace Data Collection Rule (DCR)<\/a><br><a href=\"#transform-examples\">Examples of transformations, based on Kusto syntax<\/a><br><a href=\"#cost-for-transformations\">Cost for transformations<\/a><br><a href=\"#data-out\">Data-out<\/a><br><a href=\"#deprecation\">Azure Log technologies being deprecated<\/a><br><a href=\"#kusto\">Accessing data using Kusto<\/a><br><a href=\"#powershell\">Accessing data using Powershell<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"technology-overview\">Technology overview<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The following technologies are used to deliver <strong>data-collection<\/strong>, <strong>data-query<\/strong> and <strong>data-presentation<\/strong> in Azure.<\/p>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table><tbody><tr><td><strong>Abbreviation<\/strong><\/td><td><strong>Technology<\/strong><\/td><td><strong>Role<\/strong><\/td><td><strong>Usage<\/strong><\/td><\/tr><tr><td>AMA<\/td><td>Azure Monitor Agent<\/td><td>Data-In (collection)<\/td><td>Agent (or Extension) running on Windows &amp; Linux endpoints.<br>Collects data defined in DCR<\/td><\/tr><tr><td>DCR<\/td><td>Azure Data Collection Rule<\/td><td>Data-Transformation<\/td><td>Definition (JSON-format), which includes:<br>What to collect (source)?<br>How to send data (streams)<br>Format to send data in (schema)<br>How to send data (extension)<br>Extension to use (optional)<br>Dataflow \/ transformations &#8211; what to do with the data<br>Destinations (Where) to send data <\/td><\/tr><tr><td>DCE<\/td><td>Azure Data Collection Endpoint<\/td><td>Data-In (collection)<\/td><td>Log ingestion endpoint for some data which needs to be transformed during upload (e.g. REST api, IIS logs)<\/td><\/tr><tr><td>KQL<\/td><td>Kusto Query Language<\/td><td>Data-query<\/td><td><\/td><\/tr><tr><td>WB<\/td><td>Azure Workbooks<\/td><td>Data-view<\/td><td><\/td><\/tr><tr><td>DB<\/td><td>Azure Dashboard<\/td><td>Data-view<\/td><td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"difference\">What is the change in architecture between v1 (MMA) and v2 (DCR)?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">For the last 5 years, I have been using the Log Analytics Data Collector API &#8211; also referred to &#8216;Azure Monitor HTTP Data Collector API&#8217; &#8211; or my short name for it &#8220;MMA-method&#8221; (v1)<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Don&#8217;t let yourself be confused, when you are searching the internet for &#8216;Azure Monitor HTTP Data Collector&#8217; and it comes up saying it is in&nbsp;<strong>public preview<\/strong>. It is&nbsp;<ins>still the legacy API<\/ins>&nbsp;which will be&nbsp;<strong>replaced<\/strong>&nbsp;by Log Ingestion API and DCRs.<\/p>\n<\/blockquote>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Product team quotes: \u201cData Collector API was never officially released or considered &#8220;complete\u201d. We are going to update Data Collector API documentation as part of its deprecation cycle\u201d<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">I have been using the API with my Powershell scripts to upload &#8216;tons&#8217; of custom data into Azure LogAnalytics. On top, I provided 35 Azure dashboards, that gives me (and my customers) great insight to the health and security of their environment.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\/blob\/main\/img\/Concept-legacy-mma.png\" target=\"_blank\" rel=\"noreferrer noopener\"><img decoding=\"async\" src=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\/raw\/main\/img\/Concept-legacy-mma.png\" alt=\"Flow-MMA\"\/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In v1, everything was defined on the backend using the concept of &#8220;solutions&#8221;. It was very hard to target from where you wanted to collect specific data. You were also limited with transformation possibilities, as you could only use XPath. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft has implemented v1 of XPath, which is very limited, as it doesn&#8217;t contain possibility to use for example <strong>like<\/strong> or <strong>contains<\/strong>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"491\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/v1-architecture-3-1024x491.png\" alt=\"\" class=\"wp-image-1583\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/v1-architecture-3-1024x491.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/v1-architecture-3-300x144.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/v1-architecture-3-768x368.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/v1-architecture-3-1536x736.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/v1-architecture-3-2048x981.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In v2 using Data Collection Rule, you will have an <strong>intermediate<\/strong> &#8211; <strong>Azure Data Ingestion Pipeline<\/strong>, which handles the data upload from endpoints &#8211; based on <strong>Data Collection Rules<\/strong>. <strong>Data Collection Rules (DCRs) <\/strong>determine how to collect and process telemetry sent to Azure.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"556\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/image-5-1024x556.png\" alt=\"\" class=\"wp-image-1614\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/image-5-1024x556.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/image-5-300x163.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/image-5-768x417.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/image-5.png 1046w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I am a big fan of <strong>Azure Data Ingestion Pipeline<\/strong> and <strong>Azure Data Collection Rules<\/strong> because:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>possibility to remove data before being sent into LogAnalytics (remove &#8220;noice&#8221; data\/cost optimization, GDPR\/compliance)<\/li>\n\n\n\n<li>possibility to add data before being sent into LogAnalytics<\/li>\n\n\n\n<li>possibility to merge data before being sent into LogAnalytics<\/li>\n\n\n\n<li>data quality is better for array data, as array data is converted into dynamic &#8211; whereas the old MMA-method would convert array data into strings<\/li>\n\n\n\n<li>support to send to other destinations<\/li>\n\n\n\n<li>support for file based logs collection (txt-logs, Windows Firewall logs)<\/li>\n\n\n\n<li>advanced support for advanced collection of performance data (including new collection type like SQL performance counters)<\/li>\n\n\n\n<li>support for SNMP traps logs collection<\/li>\n\n\n\n<li>security is based on Azure AD RBAC<\/li>\n\n\n\n<li>naming of data columns are prettier, as they contain the actual name &#8211; and not for example ComputerName_s indicating it is a string value<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If I should mention some challenges, then they are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>complexity is higher, because you have more &#8220;middle-tiers&#8221; involved (DCR, DCE)<\/li>\n\n\n\n<li>table\/DCR\/schema must be defined before sending data <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">I have built a Powershell module, <strong>AzLogDcrIngestPS<\/strong>, which deals with these challenges. You can check it out the documentation on <a href=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\" target=\"_blank\" rel=\"noreferrer noopener\">github<\/a>. It can also be <a href=\"https:\/\/www.powershellgallery.com\/packages\/AzLogDcrIngestPS\" target=\"_blank\" rel=\"noreferrer noopener\">downloaded on Powershell Gallery<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"data-in-sources\">Data-in (sources)<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft supports data from the following&nbsp;<strong>sources (data-in)<\/strong>:<\/p>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table><thead><tr><th>Collection source<\/th><th>Technologies required<\/th><th>Flow<\/th><\/tr><\/thead><tbody><tr><td>(legacy)<br>Performance<br>Eventlog<br>Syslog<\/td><td>MMA (legacy)<\/td><td>1. MMA<br>2. Azure LogAnalytics<\/td><\/tr><tr><td>(legacy)<br>API<\/td><td>HTTP Data Collection API (legacy)<\/td><td>1. REST API endpoint<br>2. Azure LogAnalytics<\/td><\/tr><tr><td>Performance<br>Eventlog<br>Syslog<\/td><td>AMA<br>DCR<\/td><td>1. AMA<br>2. DCR ingestion pipeline<br>3. Azure LogAnalytics<\/td><\/tr><tr><td>Text log<br>IIS logs<br>Windows Firewall logs (preview)<\/td><td>AMA<br>DCR<br>DCE<\/td><td>1. AMA<br>2. DCE<br>3. DCR ingestion pipeline<br>4. Azure LogAnalytics<\/td><\/tr><tr><td>SNMP traps<\/td><td>Linux with SNMP trap receiver<br>AMA<br>DCR (syslog file)<br><br>-or-<br><br>AMA<br>DCR (syslog stream)<\/td><td>1. AMA<br>2. DCR ingestion pipeline<br>3. Azure LogAnalytics<\/td><\/tr><tr><td>Change Tracking (legacy)<\/td><td>Change Tracking Extension (FIM)<br>DCR<\/td><td>1. FIM<br>2. DCR ingestion pipeline<br>3. Azure LogAnalytics<\/td><\/tr><tr><td>REST Log Ingestion API<\/td><td>REST endpoint<br>DCR<br>DCE<\/td><td>1. REST endpoint<br>2. DCE<br>3. DCR ingestion pipeline<br>4. Azure LogAnalytics<\/td><\/tr><tr><td>Platform Metrics\/Telemetry (standard) Azure PaaS<\/td><td>DCR (build-in, non-manageable)<\/td><td>1. Azure Resource<br>2. DCR ingestion pipeline<br>3. Azure Monitor Metrics<\/td><\/tr><tr><td>Custom Metrics\/Telemetry (custom app)<\/td><td>Windows (1):<br>AMA<br>DCR<br><br>-or-<br><br>Windows (2):<br>Azure Diagnostics extension<br><br>-or-<br><br>API:<br>Azure Monitor REST API<br><br>-or-<br><br>Linux: Linux InfluxData Telegraf agent (Linux)<br>Azure Monitor output plugin<\/td><td>Windows (1):<br>1. AMA<br>2. DCR ingestion pipeline<br>3. Azure LogAnalytics<br><br>Windows (2):<br>1. Azure Diagnostics<br>2. Azure LogAnalytics<br><br>API:<br>1. REST endpoint<br>2. DCE<br>3. DCR ingestion pipeline<br>4. Azure LogAnalytics<br><br>Linux:<br>1. Linux InfluxData<br>2. Azure Monitor output plugin<br>3. Azure LogAnalytics<\/td><\/tr><tr><td>Platform logs (diagnostics per resource)<br>AllMetrics<br>Resource logs (allLogs, audit)<\/td><td>Azure Policy (diagnostics)<br>DCR<\/td><td>1. Azure Resource<br>2. DCR ingestion pipeline<br>3. Azure LogAnalytics<\/td><\/tr><tr><td>Activity logs (audit per subscription)<\/td><td>Azure Policy (diagnostics)<br>DCR<\/td><td>1. Azure Resource<br>2. DCR ingestion pipeline<br>3. Azure LogAnalytics<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">I will be covering collecting the above data sources in later blog posts, which can be found in the <a href=\"https:\/\/mortenknudsen.net\/?p=1687\" target=\"_blank\" rel=\"noreferrer noopener\">overview here<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"Data-transformation\">Data-transformation<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">As mentioned, data transformation is a new feature of Data Collection Rules which can be used together with AMA DCR, workspace DCR and Log Ingestion API.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Transformations defines which data should be sent through the pipeline.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to exclude specific events, you will tell to exclude these events. Example if you want to exclude eventid 4662<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>source where (EventID != 4662)<\/strong><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Data transformations runs in the <strong>Azure Data Ingestion Pipeline<\/strong> and happens very fast as data is being uploaded.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"315\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/transformation-1-1024x315.png\" alt=\"\" class=\"wp-image-1795\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/transformation-1-1024x315.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/transformation-1-300x92.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/transformation-1-768x236.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/transformation-1-1536x473.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/transformation-1-2048x630.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Data transformations are defined in the <strong>transformKq<\/strong>l property in the DCR section <strong>dataFlows<\/strong>.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>dataFlows\": &#91;\n            {\n                \"streams\": &#91;\n                    \"Microsoft-SecurityEvent\"\n                ],\n                \"destinations\": &#91;\n                    \"DataCollectionEvent\"\n                ],\n               <strong> \"transformKql\": \"source | where (EventID != 8002) and (EventID != 5058) and (EventID != 4662) \",<\/strong>\n                \"outputStream\": \"Microsoft-SecurityEvent\"\n            }<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Since the transformation is applied to each record individually, it can&#8217;t use any KQL operators that act on multiple records. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only operators that take a single row as input and return no more than one row are supported. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example,&nbsp;<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/data-explorer\/kusto\/query\/summarizeoperator\">summarize<\/a>&nbsp;isn&#8217;t supported since it summarizes multiple records. See&nbsp;<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/azure-monitor\/essentials\/data-collection-transformations-structure#supported-kql-features\">Supported KQL features<\/a>&nbsp;for a complete list of supported features.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">As shown below, you can do great things with the concept of&nbsp;<strong>data transformation<\/strong>:<\/p>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table><thead><tr><th>Category<\/th><th>Details<\/th><\/tr><\/thead><tbody><tr><td>Compliance<\/td><td>You may have a data source that sends information you don\u2019t want stored for privacy or compliancy reasons &#8211; for example to support GDPR.<br><br><strong>Filter sensitive information<\/strong>. Filter out entire rows or just particular columns that contain sensitive information (UserNames, PersonalID, PhoneNumbers)<br><br><strong>Obfuscate sensitive information<\/strong>. For example, you might replace digits with a common character in an IP address or telephone number (40 178 xxx).<\/td><\/tr><tr><td>Enrich data<\/td><td>Use a transformation to add information to data that provides business context or simplifies querying the data later.<br><br><strong>Add a column with additional information<\/strong>. For example, you might add a column identifying whether an a server is internet-connected or with no-internet access. It can also be about IP address is internal or external.<br><br><strong>Add business specific information<\/strong>. For example, you might add a column showing company tenantId in case you have multiple tenants.<\/td><\/tr><tr><td>Cost optimizations<\/td><td>Since you\u2019re charged by Gb, you want to filter out any data that you don\u2019t require to reduce your costs.<br><br><strong>Remove entire rows<\/strong>. For example, you might want to remove all entries (rows) where the source is coming from a specific server if the events contains a specific eventid.<br><br><strong>Remove a column from each row<\/strong>. For example, your data may include columns with data that\u2019s redundant or has minimal value. Maybe you parse RawData in Syslog into multiple columns, thne you need to remove the RawData column, when you have parsed the data.<br><br><strong>Parse important data from a column<\/strong>. You may have a table with valuable data buried in a particular column. .<br><br>Examples of where data-transformation is useful:<br><br>We want to remove specific security-events from a server, which are making lots of \u201dnoise\u201d in our logs due to a misconfiguration or error and it is impossible to fix it.<br><br>We want to remove security events, which we might show with a high amount, but we want to filter it out like Kerberos computer-logon traffic.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can read about how to implement data transformation in this <a href=\"https:\/\/mortenknudsen.net\/?p=1440\" target=\"_blank\" rel=\"noreferrer noopener\">blog-post<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"support-transformation\">Supported ways of doing data transformation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Currently, Microsoft supports doing transformation using 4 methods:<\/p>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table><thead><tr><th>Collection source<\/th><th>How<\/th><th>Purpose \/ limitatations<\/th><\/tr><\/thead><tbody><tr><td>XPath<\/td><td>XML syntax in DCR<\/td><td>XPath implementation uses v1, which is very limited in functionality.<\/td><\/tr><tr><td>MMA-agent \/ Solutions (legacy):<br>Performance<br>Eventlog<br>Syslog<br><br>API (legacy):<br>HTTP Data Collector API<\/td><td>Workspace transformation DCR<\/td><td>Only one transformation per table<\/td><\/tr><tr><td>All sources sending in using AMA<\/td><td>AMA transformation DCR<\/td><td>All DCRs do unions, so be aware of double data. Governance is important<\/td><\/tr><tr><td>REST API using Log ingestion API<\/td><td>Log Ingestion transformation DCR<\/td><td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS#transformation-with-azure-monitor-agent-ama--azure-data-collection-rules-dcr\"><\/a><\/h3>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"xpath\">Transformation using XPath<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Since AMA was launched in June 2021, it has supported doing transformation with XPath. This methods works fine and has helped my customers to save money.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Microsoft asked me to provide a <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/azure-observability-blog\/a-powerful-agent-for-azure-monitor-and-a-simpler-world-of-data\/ba-p\/2443285\" target=\"_blank\" rel=\"noreferrer noopener\">statement<\/a> about this in the officiel go-live announcement, when Azure Monitor Agent went GA in June 2021.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Here is an example of using XPath where I am collecting all security events, excluding any computer-related security-events like Computer logon-traffic from specific exchange servers.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>Security!*&#91;System&#91;(band(Keywords,13510798882111488))]] and &#91;(EventData&#91;Data&#91;@Name='TargetUserName'] != 'EXCHANGE01$'])] and &#91;(EventData&#91;Data&#91;@Name='TargetUserName'] != 'EXCHANGE02$'])] and &#91;(EventData&#91;Data&#91;@Name='TargetUserName'] != 'EXCHANGE03$'])] and &#91;(EventData&#91;Data&#91;@Name='TargetUserName'] != 'EXCHANGE04$'])] and &#91;(EventData&#91;Data&#91;@Name='TargetUserName'] != 'EXCHANGE05$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain\\\\EXCHANGE01$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain\\\\EXCHANGE02$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain\\\\EXCHANGE03$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain\\\\EXCHANGE04$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain\\\\EXCHANGE05$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain.DK\\\\EXCHANGE01$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain.DK\\\\EXCHANGE02$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain.DK\\\\EXCHANGE03$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain.DK\\\\EXCHANGE04$'])] and &#91;(EventData&#91;Data&#91;@Name='SubjectUserName'] != 'domain.DK\\\\EXCHANGE05$'])]<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">AMA is still supporting XPath, but I recommend to use data transformation using DCR-rules, as it solves some of the limitations in the XPath implementation in AMA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">XPath is a standard, currently at 3.1 (2017), but Microsoft chose to implement XPath v1 in AMA from 1999. V1 doesn\u2019t support filtering with&nbsp;<strong>like<\/strong>&nbsp;or&nbsp;<strong>contains<\/strong>. Therefore it is hard to scale using xpath v1, if you need advanced features.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the sample above, I had to explicitly define the server-names where I wanted to remove computer-related security events.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"transform-pipeline-dcr\">Transformation with Azure Monitor Agent (AMA) &amp; Azure Data Collection Rules (DCR)<\/h2>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\/blob\/main\/img\/Concept-transformation-ama.png\" target=\"_blank\" rel=\"noreferrer noopener\"><img decoding=\"async\" src=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\/raw\/main\/img\/Concept-transformation-ama.png\" alt=\"Transformation\"\/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><br><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"transform-logapi\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS#transformation-with-azure-dcr-pipeline-log-ingestion-api--azure-data-collection-rule-dcr\"><\/a>Transformation with Azure DCR-pipeline (Log Ingestion API) &amp; Azure Data Collection Rule (DCR)<\/h2>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\/blob\/main\/img\/Concept-transformation-log-ingest.png\" target=\"_blank\" rel=\"noreferrer noopener\"><img decoding=\"async\" src=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\/raw\/main\/img\/Concept-transformation-log-ingest.png\" alt=\"Transformation\"\/><\/a><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><br><br><a href=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS#transformation-with-azure-loganalytics-workspace-data-collection-rule-dcr\"><\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"transform-workspace\">Transformation with Azure LogAnalytics Workspace Data Collection Rule (DCR)<\/h2>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\/blob\/main\/img\/Concept-transformation-workspace.png\" target=\"_blank\" rel=\"noreferrer noopener\"><img decoding=\"async\" src=\"https:\/\/github.com\/KnudsenMorten\/AzLogDcrIngestPS\/raw\/main\/img\/Concept-transformation-workspace.png\" alt=\"Transformation\"\/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"transform-examples\">Examples of transformations, based on Kusto syntax<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To create a transformation, you will start by defining the query in LogAnalytics using Kusto. When the query is working, you will change the tablename to&nbsp;<strong>source<\/strong>&nbsp;&#8211; as shown below<\/p>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table><thead><tr><th>Kusto Query<\/th><th>Purpose<\/th><th>Transformation syntax for DCR &#8216;transformKql&#8217; command<\/th><\/tr><\/thead><tbody><tr><td>SecurityEvent | where (EventID != 12345)<\/td><td>Remove events with EventID 12345 in SecurityEvent table<\/td><td>source | where (EventID != 12345)<\/td><\/tr><tr><td>SecurityEvent | where (EventID != 8002) and (EventID != 5058) and (EventID != 4662)<\/td><td>Remove events with EventId 4662,5058,8002 in SecurityEvent table<\/td><td>source | where (EventID != 8002) and (EventID != 5058) and (EventID != 4662)<\/td><\/tr><tr><td>Event | where ( (EventID != 10016 and EventLog == \u201cApplication\u201d) )<\/td><td>Remove events with EventID 10016, if source is Application log<\/td><td>source | where ( (EventID != 10016 and EventLog == \u201cApplication\u201d) )<\/td><\/tr><tr><td>CommonSecurityLog<br>| where (DeviceVendor !contains &#8220;sonicwall&#8221;) or ((DeviceVendor contains &#8220;sonicwall&#8221;) and (Activity contains &#8220;connection opened&#8221; or Activity contains &#8220;connection closed&#8221;) and (Protocol != &#8220;udp\/dns&#8221;))<\/td><td>remove all DNS lookups if coming from sonicwall only &#8211; not Cisco<\/td><td>source<br>| where (DeviceVendor !contains &#8220;sonicwall&#8221;) or ((DeviceVendor contains &#8220;sonicwall&#8221;) and (Activity contains &#8220;connection opened&#8221; or Activity contains &#8220;connection closed&#8221;) and (Protocol != &#8220;udp\/dns&#8221;))<\/td><\/tr><tr><td>Inventory_CL | extend TimeGenerated = now()<\/td><td>Add new column TimeGenerated with the actual time (now), when data is coming in<\/td><td>source | extend TimeGenerated = now()<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are interested in learning more, please check out this topic in my <a href=\"https:\/\/mortenknudsen.net?p=1440\" target=\"_blank\" rel=\"noreferrer noopener\">tutorial blog<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"cost-for-transformations\">Cost for transformations<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">While transformations themselves don&#8217;t incur direct costs, the following scenarios can result in additional charges:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If a transformation increases the size of the incoming data, such as by adding a calculated column, you&#8217;ll be charged the standard ingestion rate for the extra data.<\/li>\n\n\n\n<li>If a transformation reduces the incoming data by <strong>more than 50%<\/strong>, you&#8217;ll be charged for the amount of filtered data <strong>above 50%<\/strong>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To calculate the data processing charge resulting from transformations, use the following formula: <strong>[GB filtered out by transformations] &#8211; ([Total GB ingested] \/ 2)<\/strong>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, if you ingest 100 GB of data and your transformations remove 70 GB, you&#8217;ll be charged for 70 GB &#8211; (100 GB \/ 2), which is 20 GB. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This calculation is done per data collection rule and per day basis. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To avoid this charge, it&#8217;s recommended to filter incoming data on the source level if possible. By doing so, you can reduce the amount of data processed by transformations and, therefore, minimize any additional costs. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example you will modify your Active Directory Audit settings, if you have general events you want to filter out. Another example could be syslog events which you want to filter out. <a href=\"https:\/\/mortenknudsen.net\/?p=450\" target=\"_blank\" rel=\"noreferrer noopener\">I have provided a blog post about this example<\/a><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">If Azure Sentinel is enabled for the Log Analytics workspace, there&#8217;s no filtering ingestion charge regardless of how much data the transformation filters.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"data-out\">Data-out<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The concept of Data Collection Rules also includes the ability to send the data to multiple destinations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Currently, DCRs support the following destinations:<\/p>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table><thead><tr><th>Collection source<\/th><th>Technologies required<\/th><th>Supported Targets<\/th><\/tr><\/thead><tbody><tr><td>Performance<br>Eventlog<br>Syslog<\/td><td>AMA<br>DCR<\/td><td>Azure LogAnalytics standard table<\/td><\/tr><tr><td>Text log<br>IIS logs<br><br>Windows Firewall logs<br>(preview)<\/td><td>AMA<br>DCR<br>DCE<\/td><td>Azure LogAnalytics custom log table<\/td><\/tr><tr><td>SNMP traps<\/td><td>Linux with SNMP trap receiver<br>AMA<br>DCR (syslog file)<br><br>-or-<br><br>AMA<br>DCR (syslog stream)<\/td><td>Azure LogAnalytics custom log table<\/td><\/tr><tr><td>Change Tracking (legacy)<\/td><td>Change Tracking Extension (FIM)<br>DCR<\/td><td>Azure LogAnalytics standard table<\/td><\/tr><tr><td>REST Log Ingestion API<\/td><td>REST endpoint<br>DCR<br>DCE<\/td><td>Azure LogAnalytics standard table (CommonSecurityLog, SecurityEvents, Syslog, WindowsEvents)<br>Azure LogAnalytics custom table<\/td><\/tr><tr><td>Platform Metrics\/Telemetry<br>(standard Azure PaaS)<\/td><td>DCR (build-in, non-manageable)<\/td><td>Azure Monitor Metrics<\/td><\/tr><tr><td>Custom Metrics\/Telemetry<br>(custom app)<\/td><td>Windows (1):<br>AMA<br>DCR<br><br>-or-<br><br>Windows (2):<br>Azure Diagnostics extension<br><br>-or-<br><br>API:<br>Azure Monitor REST API<br><br>-or-<br><br>Linux: Linux InfluxData Telegraf agent (Linux)<br>Azure Monitor output plugin<\/td><td>Azure Monitor Metrics<\/td><\/tr><tr><td>Platform logs<br>(diagnostics per resource)<br><br>AllMetrics<br><br>Resource logs <br>(allLogs, audit)<\/td><td>Azure Policy (diagnostics)<br>DCR<\/td><td>Azure LogAnalytics standard table<\/td><\/tr><tr><td>Activity logs<br>(audit per subscription)<\/td><td>Azure Policy (diagnostics)<br>DCR<\/td><td>Azure LogAnalytics standard table<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It is possible to send to multiple tables in LogAnalytics, which is covered in more details <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/azure-monitor\/essentials\/data-collection-transformations#multiple-destinations\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You should expect to see more &#8216;destinations&#8217; in the future, DCRs can send data to. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I am really excited about the future&nbsp;\ud83d\ude04<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"deprecation\"><br>Azure Log technologies being deprecated <\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The following technologies will be deprecated:<\/p>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table><tbody><tr><td><strong>Technology<\/strong><\/td><td><strong>Deprecation Time<\/strong><\/td><td><strong>Replacement Technology<\/strong><\/td><\/tr><tr><td>Microsoft Monitoring Agent<\/td><td>Aug 2024<\/td><td>Azure Monitor Agent<\/td><\/tr><tr><td>HTTP Data Collector API<\/td><td>N\/A<br>I expect it to be deprecated medio-2024<\/td><td>Log Ingestion API<\/td><\/tr><tr><td>Azure LogAnalytics Custom Log table (v1 &#8211; MMA)<\/td><td>N\/A<br>I expect it to be deprecated medio-2024<\/td><td>Azure LogAnalytics Custom Log table (v2 &#8211; DCR)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Migration will be covered in a separate blog-post later. You can find the details <a href=\"https:\/\/mortenknudsen.net?p=1904\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"kusto\"><br>Accessing data using Kusto<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You can use Kusto (KQL) to query the data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/youtu.be\/_GlI0h7ZOsg\" target=\"_blank\" rel=\"noreferrer noopener\">Here is an video which will demonstrate several Kusto commands<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"powershell\"><br>Accessing data using Powershell<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You can use the <strong>Az.OperationalInsights<\/strong> module to access the data in Azure LogAnalytics tables. Below is an example.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You need to be validated using Connect-AzAccount (RBAC) before you can retrieve the data. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/youtu.be\/3ZDyTwiLU0w\" target=\"_blank\" rel=\"noreferrer noopener\">Video demonstrating how you can integrate data in Azure LogAnalytics with a Powershell script &#8211; and build an Excel file covering warranty-information based on log-data. <\/a><\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>Connect-AzAccount\n\n$LogAnalyticsWorkspaceId        = \"a8c786cb-e8c1-40b8-9eb9-xxxxxxxx\" \n\n$Query = @'\n            InvClientComputerInfoBiosV2_CL \n            | summarize TimeGenerated = arg_max(TimeGenerated,*) by Computer\n                | join (InvClientComputerInfoSystemV2_CL\n                |    summarize TimeGenerated = arg_max(TimeGenerated,*) by Computer)\n                   on $left.Computer == $right.Computer\n                | join (InvClientComputerOSInfoV2_CL \n                |    summarize TimeGenerated = arg_max(TimeGenerated,*) by Computer)\n                   on $left.Computer == $right.Computer\n            | project Computer, UserLoggedOn, SerialNumber, Manufacturer, PCSystemType, SystemFamily, Model, Windows=Caption2, WindowsVersion=Version1, TimeGenerated\n'@\n\nwrite-output \"Collecting computer information from LogAnalytics\"\n$Query = Invoke-AzOperationalInsightsQuery -WorkspaceId $LogAnalyticsWorkspaceId -Query $Query\n$ComputerInfoArray = $Query.Results\n\n$ComputerInfoArray<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Azure includes lots of great technologies, which can be used for logging purpose. Currently, Microsoft is transitioning from v1-method (MMA) &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Understanding Azure logging capabilities in depth\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=1433#more-1433\" aria-label=\"Read more about Understanding Azure logging capabilities in depth\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":2155,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[140,55,59,129,131,61,128,54,143,141,57,139,136,138,137,142,133,134,60,132,58,135],"tags":[],"class_list":["post-1433","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ama","category-azure","category-azure-arc","category-azure-data-collection-rules","category-azure-data-ingestion-pipeline","category-azure-extensions","category-azure-log-ingestion-api","category-azure-loganalytics","category-azure-logging","category-azure-monitor-agent","category-azure-security","category-data-collection-endpoint","category-data-transformation","category-dce","category-dcr","category-logging","category-microsoft-security","category-mvpbuzz","category-scripting","category-security","category-sentinel","category-transformation","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/53A1655_fritlagt_udenskygge.png","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/53A1655_fritlagt_udenskygge.png","_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1433"}],"version-history":[{"count":84,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1433\/revisions"}],"predecessor-version":[{"id":2289,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1433\/revisions\/2289"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/2155"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}