Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
06Connect logs to Microsoft Sentinel7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence0/49 units complete−
Learning path 06 · Connect logs to Microsoft Sentinel ↗

7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence

0%

Study focus

Data onboarding

Select and configure connectors for Microsoft services, Defender, Windows, CEF, and Syslog sources.

Collection reliability

Plan agents, data collection rules, forwarding, destination tables, threat indicators, and ingestion validation.

7 modules · 49 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

06Connect Syslog data sources to Microsoft Sentinel0/7 units−
06

Module 6

Connect Syslog data sources to Microsoft Sentinel

Focus: Linux AMA architecture, Azure Arc, facility and severity filters, validation, and reusable KQL parsers.
0/7
01 / 07Introduction

Plain Syslog collection supports Linux hosts and appliances that do not emit CEF. AMA and a DCR control source scope, facilities, severities, and the Sentinel workspace destination.

Official moduleSyslog objectives
02 / 07Plan for Syslog data collection

The native rsyslog or syslog-ng daemon receives local messages and forwards them through a local Unix domain socket to AMA. AMA sends them over HTTPS to Log Analytics, where Sentinel exposes them in the Syslog table.

Use supported Linux distributions and avoid end-of-life systems. Decide which facilities and minimum severities provide security value before broad collection.

Official lessonDaemon-to-AMA architecture
03 / 07Collect data from Linux-based sources using Syslog

For an Azure VM, create a Linux-platform DCR, add the VM, choose Linux Syslog as the data source, and send it to Azure Monitor Logs; AMA installs as an extension. For non-Azure Linux, generate and run the Azure Arc onboarding script, connect azcmagent, verify Connected status, then associate the Arc machine with the DCR.

Exam takeaway: Azure Arc provides the Azure resource identity and extension management required to deploy AMA and associate DCRs with non-Azure hosts.
Official lessonAzure VM and Arc-enabled Linux onboarding
04 / 07Configure the Data Collection Rule for Syslog data sources

Edit the DCR's Linux Syslog data source to set a minimum log level for each facility and confirm the destination. The lesson default is LOG_DEBUG for every facility, which can produce high volume. Saved changes are pushed to all associated resources.

Collect only severities required by use cases, but document exclusions because aggressive filtering creates permanent visibility gaps.

Official lessonFacilities, severities, and destination
05 / 07Parse Syslog data with KQL

Plain Syslog stores the message body in SyslogMessage. Parse fields with extract or parse, then save stable logic as a KQL function so analytics, workbooks, and hunting queries can reference it like a table.

Syslog
| where ProcessName contains "squid"
| extend SourceIP = extract(@"(\d{1,3}(?:\.\d{1,3}){3})", 1, SyslogMessage),
         Domain = extract(@"https?://([^/: ]+)", 1, SyslogMessage)
Exam takeaway: CEF arrives parsed in CommonSecurityLog; plain Syslog requires recurring parsing unless encapsulated in a saved parser function.
Official lessonSyslogMessage parsing and functions
06 / 07Module assessment

Review native daemon flow, AMA and DCR roles, Azure versus Arc onboarding, facility/severity filters, the Syslog table, and parser functions.

Official assessmentSyslog knowledge check
07 / 07Summary and resources

Use AMA and DCRs for consistent Linux collection, Arc for non-Azure machines, deliberate facility/severity filters for cost control, and reusable parsers for normalized analysis.

Official moduleSummary and resources
End of learning pathConnect logs to Microsoft Sentinel
↑