LEARN. PRACTICE. GROW.Concept and mechanism
An investigation depends on data actually being available. For Syslog or CEF through AMA, identify the appliance, forwarder daemon, agent, DCR association, filters, and target table. An agent heartbeat does not prove that the facility and severity emitted by the source are included. Compare an identifiable event at source and destination to validate fields and chronology. If two configurations collect the same stream, volume and cost can rise without additional source activity. Distinguish ingestion duplication from query-produced duplication. Connector monitoring also has scope: SentinelHealth requires enablement and supports specific connectors, so absent events do not prove universal health.
Guided application
For a fictional L3 handover, document the collection path and who can change each component. Reader, Responder, and Contributor are not equivalent: managing incidents does not automatically require creating rules or changing resources. Confirm assignment scope and additional permissions for specific actions. Use a test message without sensitive data to demonstrate arrival in the expected table. Record observed latency, intentional filters, and the response to falling volume. If a migration interrupts events, communicate a visibility gap and use change-recovery criteria. Do not announce a security improvement merely because alerts stopped reaching the SOC.
The source sends local4 while the DCR selects auth: the agent can be healthy while relevant events are not collected.
Common pitfalls
Heartbeat as coverage; absent SentinelHealth as health; editing permissions for everyone; duplication without cost.
Related topics: Windows, delays, and entities · Detections and controlled automation
Validate the complete path and assign permissions by operation and scope.
Reference: CEF and Syslog via AMA · SC-200 objectives effective 2026-07-28; Microsoft product documentation reviewed 2026-10-01; 2026-10-21 English update compared separately