Learning path
Microsoft Sentinel - Data Connectors and Ingestion
Skill Level
Fundamentals
Duration 10 minutes
Updated Oct 28, 2026
About this learning path
In this ATC Byte, you will learn how Sentinel brings data in. You will see how to choose between service, agent, and API connectors, how data collection rules filter and shape logs before they land, and how the analytics and data lake tiers keep cost in check. You will also learn how to watch connector health, so a quiet source never goes unnoticed. In about five minutes, you will know how to build a pipeline you can trust.
Your instructors
Prerequisites
- Comfort reading simple Kusto queries, since transformations and health checks are written in them.
- Know your way around Microsoft Sentinel in the Microsoft Defender portal, including the Content hub and Configuration pages.
- Familiarity with Log Analytics workspaces, resource groups, and the roles that manage them.
- A working feel for Syslog, Common Event Format, and how firewalls and servers send their logs.
What you'll learn
- Explain why Microsoft Sentinel can only detect what it receives, and how ingestion drives both cost and blind spots.
- Compare the main connector paths (service to service, Azure Monitor Agent for Syslog and CEF, Codeless Connector Framework, and the Logs Ingestion API) and find them in the Content hub.
- Recognize the retired ingestion paths to leave behind, including the Log Analytics agent and the HTTP Data Collector API.
- Use data collection rules to filter, enrich, mask, and normalize data before it is stored.
- Choose between the analytics tier and the data lake tier for each table, and understand how retention works across both.
- Turn on connector health monitoring, read the health workbook, and set alerts so a silent source never goes unnoticed.