▲ 10 Logon Type 3 is flooding my logs, can I filter it out? asked by a8hda 1 month ago Thousands per hour, looks like mostly machine accounts hitting file shares. Safe to drop?
Filter the machine accounts, keep the rest.
Type 3 with an account name ending in
$is a computer account doing normal domain business. That is your volume and it is almost never interesting.Type 3 from a user account is worth keeping. Lateral movement looks exactly like that.
So the filter is on the account name, not on the logon type.