Manage a security operations environment
Sentinel Data Ingestion
CoreChoose the connector and collection path that match each source, then validate agents, collectors, data collection rules, transformations, and destinations.
Aligned to SC-200 skills measured as of July 28, 2026; product behavior verified September 18, 2026.
Why this matters
Every later detection depends on trustworthy telemetry. A healthy workspace cannot compensate for a DCR that filters the wrong event IDs, a WEF subscription that never forwards events, or a diagnostic setting that targets the wrong destination.
Must Know
- Windows Security Events via AMA uses DCRs to select events from associated Windows machines. WEF first aggregates events into a collector before Sentinel ingests ForwardedEvents.
- Use Syslog via AMA for syslog messages and CEF via AMA for devices that emit Common Event Format through a Linux collector.
- Azure Activity covers subscription control-plane events; resource logs require diagnostic settings on the resources. Azure Policy can deploy those settings repeatedly.
- Threat-intelligence connectors ingest structured indicators and their validity metadata for hunting and correlation.
- Custom tables require a compatible schema and an ingestion transformation that maps and converts incoming fields.
Compare and Distinguish
- A connector defines integration with a source; an agent transports supported telemetry; a data collection rule selects and transforms what is collected.
- WEF first consolidates Windows events on a collector; Windows Security Events via AMA can collect from managed machines under a DCR.
- Syslog is a protocol and message format; CEF is a normalized security-event format transported through Syslog.
Scenario examples
- Scenario: Hundreds of Windows servers need a controlled subset of Security events. Think: use AMA with a DCR that selects the required events.
- Scenario: A network appliance emits CEF. Think: configure CEF via AMA through a supported Linux collector path.
- Scenario: New subscriptions must send resource logs consistently. Think: deploy diagnostic settings at scale with Azure Policy.
Exam traps
- A workbook filter reduces what is displayed, not what is ingested or billed.
- An online WEF collector proves neither that source subscriptions work nor that ForwardedEvents contains data.
- Azure Activity does not automatically contain each resource's data-plane or diagnostic logs.
- The presence of an expired indicator does not make it current intelligence.
Key takeaways
- Trace missing data upstream from table to DCR, agent or collector, source configuration, and event generation.
- Match message format to connector and table expectations.
- Fix data type and field mapping at ingestion when downstream queries require a stable schema.
How it works
- Agents or collectors receive source events, DCRs select and transform them, and configured destinations write them into workspace tables.
- Azure diagnostic settings export selected resource categories, while Policy can deploy consistent settings to matching resources.
Objects and administrative surfaces
- Sentinel content hub and data connector pages for connector installation and configuration.
- Azure Monitor Agent and data collection rules for machine telemetry.
- Azure Policy and diagnostic settings for scalable Azure resource log routing.
When to use it
- Use WEF when Windows sources must aggregate through a collector before cloud ingestion.
- Use a custom table when incoming records need a stable schema not supplied by a built-in connector.
Security and governance implications
- Collect the event categories needed for detection and investigation without indiscriminate high-volume ingestion.
- Protect connector credentials and record who changes DCR filters or transformations.
Troubleshooting signals
- Trace an empty table backward through destination, DCR association, agent health, collector input, and source event generation.
- Compare incoming types with table schema and transformation output when fields are null or cannot be compared.
More detail
- Windows Security Events via AMA uses DCRs to select events from associated Windows machines. WEF first aggregates events into a collector before Sentinel ingests ForwardedEvents.
- Use Syslog via AMA for syslog messages and CEF via AMA for devices that emit Common Event Format through a Linux collector.
- Azure Activity covers subscription control-plane events; resource logs require diagnostic settings on the resources. Azure Policy can deploy those settings repeatedly.
- Threat-intelligence connectors ingest structured indicators and their validity metadata for hunting and correlation.
- Custom tables require a compatible schema and an ingestion transformation that maps and converts incoming fields.
Ready for the quiz?
- When is WEF needed in addition to AMA?
- Why might AzureActivity exist while Key Vault audit logs are absent?
- What would cause a custom numeric field to arrive as text?
Related objectives
- D1.3.S1 — Select data connectors based on data source requirements, including Windows logs and security events
- D1.3.S2 — Configure collection of Windows Security events by using Windows Security Events via AMA, including data collection rules
- D1.3.S3 — Plan and configure collection of Windows Security events by using Windows Event Forwarding (WEF)
- D1.3.S4 — Plan and configure Syslog via AMA and Common Event Format (CEF) via AMA connectors
- D1.3.S5 — Configure collection of Azure activities by using Azure Policy and resource diagnostic settings
- D1.3.S6 — Ingest threat indicators into Microsoft Sentinel
- D1.3.S7 — Create custom log tables in the workspace to store ingested data