2Sentinel SIEM platform and data ingestion

• 2.1Sentinel roles, data retention, and SOC optimization

  Understand specifying Microsoft Sentinel roles, data retention across XDR/Sentinel tables (Analytics, Data lake, XDR tiers), creating workbooks, and SOC optimization recommendations.

• 2.2Data connectors and collecting Windows events

  Understand selecting data connectors by source requirements, collecting via Windows Security Events through AMA (data collection rules, DCR), and planning/configuring Windows Event Forwarding (WEF).

• 2.3Syslog/CEF, Azure activities, and threat indicators

  Understand Syslog via AMA and Common Event Format (CEF) via AMA connectors, collecting Azure activities (Azure Policy, resource diagnostic settings), ingesting threat indicators, and creating custom log tables.