Study guide
Technical reference and lesson notes
Microsoft Sentinel is built on top of a Log Analytics workspace. Its effectiveness depends on collecting the right security telemetry and understanding how that data is represented.
Data comes first
Connectors bring data from Microsoft services, infrastructure, applications, and third-party products into the workspace. Tables then provide the structure that KQL queries use.
Collection should be intentional
More data is not automatically better. Collection choices affect cost, retention, detection quality, and investigation speed.
- Collect telemetry that supports known detections and investigations.
- Understand which connector owns each data path.
- Validate data freshness and parsing before trusting a detection.
Operational takeaway
When an analytic rule appears broken, confirm that the underlying table is receiving the expected records before troubleshooting the rule itself.