What's changed: Created SC-200 Chapter 2 (Domain 1 middle: Sentinel roles/data retention (Analytics, Data lake, XDR tiers)/workbooks/SOC optimization; data connector selection/Windows Security Events via AMA/Azure Monitor Agent (AMA)/data collection rules (DCR)/Windows Event Forwarding (WEF); Syslog via AMA, CEF via AMA/Azure activities (resource diagnostic settings, Azure Policy)/threat indicators (IOCs, threat intelligence connectors)/custom log tables).
2.2Data connectors and collecting Windows events
Understand selecting data connectors by source requirements, collecting via Windows Security Events through AMA (data collection rules, DCR), and planning/configuring Windows Event Forwarding (WEF).
A SIEM works "only once the right data flows in." Analysts select the right data connector per source and precisely design what/how much to collect via data collection rules.
2.2.1Selecting data connectors
Data connectors exist per source—Microsoft products (Defender XDR, Entra ID, Defender for Cloud, etc.), Azure, AWS/GCP, third-party appliances. Analysts choose connectors based on data-source requirements (what to detect/investigate, log format). To collect Windows security events, the standard is the Windows Security Events via AMA connector using the Azure Monitor Agent (AMA).
2.2.2AMA, DCR, and WEF
The Azure Monitor Agent (AMA) succeeds MMA/Log Analytics agents and defines what to collect declaratively via a data collection rule (DCR) (e.g., all / audit-policy-aligned / minimal Windows security events). To aggregate many servers, plan Windows Event Forwarding (WEF) to forward events to a collector (WEC), then ingest via AMA. Decide between "agent on each server" vs "aggregate with WEF first" by scale.
Cues: "pick the ingestion point matching source requirements" = data connector. "collect Windows security events from each server" = Windows Security Events via AMA (collection defined by DCR). "aggregate many servers first, then ingest" = WEF (→ WEC → AMA). AMA succeeds MMA/Log Analytics agents.
Watch the mix-ups: (1) AMA (the agent) vs DCR (the rule for what to collect). (2) WEF is "server-aggregation forwarding"; AMA is "ingestion into Sentinel"—different roles, used together. (3) The old MMA/Log Analytics agents are deprecated—use AMA.
2.2.3Section summary
- Select data connectors by source requirements; Windows security events via Windows Security Events via AMA
- Ingest via AMA (agent, successor to MMA) + DCR (declares collection); aggregate many servers via WEF first
- WEF (aggregation forwarding) and AMA (ingestion) have different roles and are used together
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to first aggregate many Windows servers’ security events in one place, then ingest into Sentinel. Which is best?
Q2. What is the standard way to collect Windows security events from individual servers into Sentinel?
Q3. In AMA, what declaratively defines "which events to collect and how much"?
Q4. Which correctly relates AMA and DCR?
Q5. When deploying a new agent, which is deprecated and should not be used?