{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/",
        "slug": "dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/"
        },
        "title": "Attach an Azure Monitor transformation to the intended data flow",
        "summary": "Check transformation placement when one stream feeds multiple destinations.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:34:52+00:00",
        "modified_at": "2026-09-17T16:35:03+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 205,
        "potentially_affected": "Apply this review to a proposed single-stage ingestion transformation. Identify every dataFlows entry using the affected stream, its output stream and its destination. Keep this assessment scoped to transformKql; the same source describes separate preview processing arrangements that require their own assessment.",
        "dse_recommendation": "DSE recommends drawing the source-to-destination paths before editing the rule.",
        "primary_source": {
            "name": "Create a transformation in Azure Monitor - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft places the transformKql property within a DCR dataFlows entry that pairs a source with a destination. The transformation affects that particular data flow before delivery. Reusing the same stream or destination elsewhere in the rule does not extend the transformation to those other entries. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Apply this review to a proposed single-stage ingestion transformation. Identify every dataFlows entry using the affected stream, its output stream and its destination. Keep this assessment scoped to transformKql; the same source describes separate preview processing arrangements that require their own assessment.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends drawing the source-to-destination paths before editing the rule. Mark exactly which paths should receive the transformation and which should preserve the original record. Have a second reviewer compare that intent with the specific JSON location. Keep the prior rule and representative sanitized test records with the change record.</p>\n<h2>Verification</h2>\n<p>Submit distinguishable test records through each affected path in an approved environment. Query every destination and compare the stored fields with the expected result for that path. Confirm that an intentionally unchanged flow remains unchanged. Investigate discrepancies before rollout, and preserve both the deployed rule and the observed destination results.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Create a transformation in Azure Monitor</a>.</p>",
        "content_text": "Source facts\nMicrosoft places the transformKql property within a DCR dataFlows entry that pairs a source with a destination. The transformation affects that particular data flow before delivery. Reusing the same stream or destination elsewhere in the rule does not extend the transformation to those other entries. Microsoft Learn.\nApplicability\nApply this review to a proposed single-stage ingestion transformation. Identify every dataFlows entry using the affected stream, its output stream and its destination. Keep this assessment scoped to transformKql; the same source describes separate preview processing arrangements that require their own assessment.\nDSE recommendation\nDSE recommends drawing the source-to-destination paths before editing the rule. Mark exactly which paths should receive the transformation and which should preserve the original record. Have a second reviewer compare that intent with the specific JSON location. Keep the prior rule and representative sanitized test records with the change record.\nVerification\nSubmit distinguishable test records through each affected path in an approved environment. Query every destination and compare the stored fields with the expected result for that path. Confirm that an intentionally unchanged flow remains unchanged. Investigate discrepancies before rollout, and preserve both the deployed rule and the observed destination results.\nOfficial references\nMicrosoft Learn: Create a transformation in Azure Monitor.",
        "content_markdown": "## Source facts\n\nMicrosoft places the transformKql property within a DCR dataFlows entry that pairs a source with a destination. The transformation affects that particular data flow before delivery. Reusing the same stream or destination elsewhere in the rule does not extend the transformation to those other entries. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create).\n\n## Applicability\n\nApply this review to a proposed single-stage ingestion transformation. Identify every dataFlows entry using the affected stream, its output stream and its destination. Keep this assessment scoped to transformKql; the same source describes separate preview processing arrangements that require their own assessment.\n\n## DSE recommendation\n\nDSE recommends drawing the source-to-destination paths before editing the rule. Mark exactly which paths should receive the transformation and which should preserve the original record. Have a second reviewer compare that intent with the specific JSON location. Keep the prior rule and representative sanitized test records with the change record.\n\n## Verification\n\nSubmit distinguishable test records through each affected path in an approved environment. Query every destination and compare the stored fields with the expected result for that path. Confirm that an intentionally unchanged flow remains unchanged. Investigate discrepancies before rollout, and preserve both the deployed rule and the observed destination results.\n\n## Official references\n\n[Microsoft Learn: Create a transformation in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Attach an Azure Monitor transformation to the intended data flow",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/",
                "headline": "Attach an Azure Monitor transformation to the intended data flow",
                "description": "Check transformation placement when one stream feeds multiple destinations.",
                "abstract": "Check transformation placement when one stream feeds multiple destinations.",
                "articleBody": "Source facts\nMicrosoft places the transformKql property within a DCR dataFlows entry that pairs a source with a destination. The transformation affects that particular data flow before delivery. Reusing the same stream or destination elsewhere in the rule does not extend the transformation to those other entries. Microsoft Learn.\nApplicability\nApply this review to a proposed single-stage ingestion transformation. Identify every dataFlows entry using the affected stream, its output stream and its destination. Keep this assessment scoped to transformKql; the same source describes separate preview processing arrangements that require their own assessment.\nDSE recommendation\nDSE recommends drawing the source-to-destination paths before editing the rule. Mark exactly which paths should receive the transformation and which should preserve the original record. Have a second reviewer compare that intent with the specific JSON location. Keep the prior rule and representative sanitized test records with the change record.\nVerification\nSubmit distinguishable test records through each affected path in an approved environment. Query every destination and compare the stored fields with the expected result for that path. Confirm that an intentionally unchanged flow remains unchanged. Investigate discrepancies before rollout, and preserve both the deployed rule and the observed destination results.\nOfficial references\nMicrosoft Learn: Create a transformation in Azure Monitor.",
                "datePublished": "2026-09-17T16:34:52+00:00",
                "dateModified": "2026-09-17T16:35:03+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Attach an Azure Monitor transformation to the intended data flow"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 205,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Create a transformation in Azure Monitor - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create"
                }
            }
        ]
    }
}