GregLab | Exam Prep

Manage a security operations environment

Sentinel Data Ingestion

Core

Choose the connector and collection path that match each source, then validate agents, collectors, data collection rules, transformations, and destinations.

Aligned to SC-200 skills measured as of July 28, 2026; product behavior verified September 18, 2026.

Why this matters

Every later detection depends on trustworthy telemetry. A healthy workspace cannot compensate for a DCR that filters the wrong event IDs, a WEF subscription that never forwards events, or a diagnostic setting that targets the wrong destination.

Must Know

  • Windows Security Events via AMA uses DCRs to select events from associated Windows machines. WEF first aggregates events into a collector before Sentinel ingests ForwardedEvents.
  • Use Syslog via AMA for syslog messages and CEF via AMA for devices that emit Common Event Format through a Linux collector.
  • Azure Activity covers subscription control-plane events; resource logs require diagnostic settings on the resources. Azure Policy can deploy those settings repeatedly.
  • Threat-intelligence connectors ingest structured indicators and their validity metadata for hunting and correlation.
  • Custom tables require a compatible schema and an ingestion transformation that maps and converts incoming fields.

Compare and Distinguish

  • A connector defines integration with a source; an agent transports supported telemetry; a data collection rule selects and transforms what is collected.
  • WEF first consolidates Windows events on a collector; Windows Security Events via AMA can collect from managed machines under a DCR.
  • Syslog is a protocol and message format; CEF is a normalized security-event format transported through Syslog.

Scenario examples

  • Scenario: Hundreds of Windows servers need a controlled subset of Security events. Think: use AMA with a DCR that selects the required events.
  • Scenario: A network appliance emits CEF. Think: configure CEF via AMA through a supported Linux collector path.
  • Scenario: New subscriptions must send resource logs consistently. Think: deploy diagnostic settings at scale with Azure Policy.

Exam traps

  • A workbook filter reduces what is displayed, not what is ingested or billed.
  • An online WEF collector proves neither that source subscriptions work nor that ForwardedEvents contains data.
  • Azure Activity does not automatically contain each resource's data-plane or diagnostic logs.
  • The presence of an expired indicator does not make it current intelligence.

Key takeaways

  • Trace missing data upstream from table to DCR, agent or collector, source configuration, and event generation.
  • Match message format to connector and table expectations.
  • Fix data type and field mapping at ingestion when downstream queries require a stable schema.
How it works
  • Agents or collectors receive source events, DCRs select and transform them, and configured destinations write them into workspace tables.
  • Azure diagnostic settings export selected resource categories, while Policy can deploy consistent settings to matching resources.
Objects and administrative surfaces
  • Sentinel content hub and data connector pages for connector installation and configuration.
  • Azure Monitor Agent and data collection rules for machine telemetry.
  • Azure Policy and diagnostic settings for scalable Azure resource log routing.
When to use it
  • Use WEF when Windows sources must aggregate through a collector before cloud ingestion.
  • Use a custom table when incoming records need a stable schema not supplied by a built-in connector.
Security and governance implications
  • Collect the event categories needed for detection and investigation without indiscriminate high-volume ingestion.
  • Protect connector credentials and record who changes DCR filters or transformations.
Troubleshooting signals
  • Trace an empty table backward through destination, DCR association, agent health, collector input, and source event generation.
  • Compare incoming types with table schema and transformation output when fields are null or cannot be compared.
More detail
  • Windows Security Events via AMA uses DCRs to select events from associated Windows machines. WEF first aggregates events into a collector before Sentinel ingests ForwardedEvents.
  • Use Syslog via AMA for syslog messages and CEF via AMA for devices that emit Common Event Format through a Linux collector.
  • Azure Activity covers subscription control-plane events; resource logs require diagnostic settings on the resources. Azure Policy can deploy those settings repeatedly.
  • Threat-intelligence connectors ingest structured indicators and their validity metadata for hunting and correlation.
  • Custom tables require a compatible schema and an ingestion transformation that maps and converts incoming fields.

Ready for the quiz?

  • When is WEF needed in addition to AMA?
  • Why might AzureActivity exist while Key Vault audit logs are absent?
  • What would cause a custom numeric field to arrive as text?

Related objectives

  • D1.3.S1 — Select data connectors based on data source requirements, including Windows logs and security events
  • D1.3.S2 — Configure collection of Windows Security events by using Windows Security Events via AMA, including data collection rules
  • D1.3.S3 — Plan and configure collection of Windows Security events by using Windows Event Forwarding (WEF)
  • D1.3.S4 — Plan and configure Syslog via AMA and Common Event Format (CEF) via AMA connectors
  • D1.3.S5 — Configure collection of Azure activities by using Azure Policy and resource diagnostic settings
  • D1.3.S6 — Ingest threat indicators into Microsoft Sentinel
  • D1.3.S7 — Create custom log tables in the workspace to store ingested data

Learn more

Free Microsoft Certified: Security Operations Analyst Associate prep

Build focused SC-200 quizzes from skill areas, topics, and product references.

Practice with exam-style multiple-choice and multiple-response questions, score breakdowns, explanations, and a compact reference for this lane's official exam domains.

Read Topics Build a quiz

Exam Weights

Exam snapshot

SC-200 at a glance

Level
Intermediate / Associate
Duration
100 minutes
Questions
No fixed live question count published
Formats
No guaranteed question-type mix
Scoring
Scaled score; 700 minimum passing score

Quiz builder

Choose your practice set

Mode

Exam fidelity: Microsoft does not publish a fixed live question count or guarantee a question-type mix for SC-200. This lane contains multiple-choice and multiple-response exam-style practice. Practice percentages do not reproduce Microsoft's scaled scoring, and difficulty labels describe this site's Intermediate Associate-level security-operations complexity rather than a Microsoft-published question rating.

Reference

SC-200 topics and reference map

Study links

SC-200 resources