Domain 4 of 4 · Chapter 2 of 3

Implement activity and event collection in Microsoft Sentinel

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing SC-500 premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Five stages every collection setup passes through
  • The workspace Microsoft Sentinel runs on
  • Who may enable, operate, and configure Sentinel
  • What a Content hub solution installs
  • Service-to-service connectors for Microsoft signals
  • Diagnostic settings connectors for Azure resources
  • Syslog and CEF collection through Azure Monitor Agent
  • Windows event collection with data collection rules
  • Windows Event Forwarding and where the agent belongs
  • Custom tables and the Logs Ingestion API
  • Automation rules: orchestration without a playbook
  • Playbooks and the permissions Sentinel needs
  • How long the workspace keeps a table's data
  • Querying Microsoft Purview Audit in the Defender portal
  • Exam pattern recognition

How the four collection paths into a Sentinel workspace differ

Collection pathService-to-service connectorDiagnostic settings connectorAgent-based collectionCustom ingestion
Typical sourceMicrosoft security services such as Microsoft Defender XDRAzure resources that emit resource logs and platform metricsLinux and Windows machines, and appliances behind a log forwarderApplications and appliances with no published connector
What you configureThe connector page after installing its Content hub solutionA diagnostic setting per resource, or one Azure Policy assignment launched from the connector pageA data collection rule plus an association to every collecting machineA custom table, a data collection rule with a transformation, and an app registration
Installed at the sourceNothingNothingAzure Monitor Agent, preceded by Azure Arc on non-Azure machinesNothing; the sender calls the ingestion endpoint over HTTPS
Where the records landThe connector's own built-in tablesBuilt-in tables named by the selected log categorySyslog, CommonSecurityLog, SecurityEvent, or WindowsEventA custom table whose name ends in _CL
Where filtering happensIn the source service's own configurationIn the log categories selected on the diagnostic settingFacility and severity, or an XPath expression, in the data collection ruleA KQL transformation in the data collection rule
Recurring mistakeBuilding a forwarder for a source that already has a native connectorScripting per-resource settings when one policy assignment covers the scopeCreating the rule and never associating the machinePosting arbitrary JSON and expecting a table schema to appear

Decision tree

Content hub solution installed? The solution is what supplies the connector No Yes Install it first Sentinel Contributor Microsoft security service? A first-party connector already exists Yes Service-to-service connector, nothing installed No Azure resource with resource logs? A diagnostic setting can route them Yes Diagnostic settings connector, per resource or policy No Machine, or appliance behind a forwarder? Can run or reach Azure Monitor Agent Yes Agent-based collection Agent and data collection rule No Custom ingestion Logs Ingestion API into a _CL table Always: scope Sentinel roles at the resource group that holds the workspace Agent-based collection also needs a rule association to every collecting machine
Cheat sheet

Cheat sheet

  • Microsoft Sentinel is enabled on a supported Log Analytics workspace
  • Enabling Sentinel and operating it require distinct access
  • Sentinel built-in roles separate viewing, incident handling, and configuration
  • Resource-group role scope simplifies Sentinel access coverage
  • The Defender portal distinguishes primary and secondary Sentinel workspaces
  • Content hub solutions package connectors with operational content
  • Content hub management requires Sentinel Contributor at resource-group scope
  • Service-to-service connectors ingest supported Microsoft security signals
  • Diagnostic settings route selected Azure resource logs to Sentinel
  • Connector status depends on recent data arrival
  • Scope Defender for Cloud ingestion separately from alert-status synchronization
  • AMA collects Syslog or CEF from a Linux source or forwarder
  • CEF and plain Syslog are stored in different Sentinel tables
  • Syslog DCR filters limit data before ingestion
  • A DCR association binds collection policy to the forwarder
  • Combined Syslog and CEF collection must prevent duplicate streams
  • Non-Azure Windows servers require Azure Arc before AMA collection
  • Windows DCRs reuse collection policy across scoped machines
  • Prebuilt Windows event sets trade breadth for ingestion volume
  • XPath expressions filter Windows events at the source
  • WEF collection places AMA on the Windows Event Collector
  • Custom Log Analytics tables use the _CL naming contract
  • A DCR maps incoming custom data to its destination schema
  • Automation rules centrally orchestrate Sentinel incident handling
  • Logic Apps playbooks perform external response workflows
  • Interactive and total retention govern different access paths
  • Defender XDR audit search depends on Microsoft Purview Audit
  • Authorize the Sentinel service account on the playbook resource group
  • Bound Purview audit searches by the applicable retention period

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. Kusto Query Language (KQL) overview
  2. What is Microsoft Sentinel?
  3. Diagnostic settings in Azure Monitor
  4. Azure Monitor Agent overview
  5. Logs Ingestion API in Azure Monitor
  6. Log Analytics workspace overview
  7. Prerequisites for deploying Microsoft Sentinel
  8. Connect Microsoft Sentinel workspaces to the Microsoft Defender portal
  9. Roles and permissions in Microsoft Sentinel
  10. Discover and deploy Microsoft Sentinel out-of-the-box content and solutions
  11. Ingest Syslog and CEF messages with the Azure Monitor Agent
  12. Microsoft Defender XDR integration with Microsoft Sentinel
  13. Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel
  14. Diagnostic settings based data connectors in Microsoft Sentinel
  15. What is Azure Arc-enabled servers?
  16. Windows agent-based data connectors for Microsoft Sentinel
  17. Collect Windows events with Azure Monitor Agent (XPath filtering)
  18. Create a custom table in a Log Analytics workspace
  19. Automate incident handling in Microsoft Sentinel with automation rules
  20. Add tasks to incidents using automation rules
  21. Automate threat response with playbooks in Microsoft Sentinel
  22. Run search jobs in Azure Monitor Logs
  23. Configure data retention and archive in Azure Monitor Logs
  24. Microsoft Purview Audit solutions overview
  25. Manage audit log retention policies in Microsoft Purview