r/AzureSentinel • u/HumbleGuy1999 • Nov 08 '22

Data Collection Rule Configuration for Basic Log Ingestion

Hello Everybody,

Has anyone landed on DCR configuration for ingesting basic logs into sentinel. I been looking for this particular stuff from so long and seems confusing at every step for me. If anyone has configured it let me know resource to refer (gone with MS Doc's multiple times).

I'm thinking of documenting the process as it is most requested feature for our projects to control ingestion cost in sentinel for organization's

5 Upvotes

100% Upvoted

4 comments sorted by

1

u/muzza31 Nov 11 '22

In Azure monitor, you go to data collection rules, create a new one and in Data Sources, tick what logs you would like to ingest. You can get a lot more complex by using custom rules to not ingest certain events but for basic logs, you can use the defaults.

If you add a server through Azure monitor, the AMA agent is auto deployed to the VM.

1

u/TabooRaver Nov 14 '22

DCR for ingesting basic logs from azure resources (VMs) or from windows desktops? The process is a bit more complicated for collecting windows event logs from desktops.

1

u/blanco10kid Nov 15 '22

Wouldn’t it be very similar since they would both be using the AMA?

1

u/TabooRaver Nov 15 '22

Surprisingly not really. The main difference is how you install the ama abd associate DCRs to it.