Microsoft · SC-200
Data ingestion
SC-200 · Lesson 6 of 14 · 31:37
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: Windows Security Events via AMA and data collection rules, Windows Event Forwarding and the WindowsEvent table, Syslog and CEF via AMA through a Linux log forwarder, diagnostic settings managed by Azure Policy, threat intelligence connectors and the upload API, and custom tables with the _CL suffix. Includes three original practice questions.
Preview the topics
- Domain controllers forward their security events to a collector through Windows Event Forwarding, and the built-in Sentinel rules for Windows security never fire. Why?
- A firewall sends CEF messages to a Linux forwarder, and the same events appear in both CommonSecurityLog and Syslog, doubling the bill. What should the engineer fix?
- Thousands of key vaults, across many subscriptions, must send their logs to Sentinel, including vaults created next year. What should the engineer use?