Data collection rule

As explained in Azure Security

A data collection rule is an Azure Monitor configuration that specifies which monitoring data to collect, how to transform it, and where to send it.

A data collection rule (DCR) configures Azure Monitor Agent (AMA) collection from an Azure VM guest OS. It defines the data sources to collect, the destination, and transformations applied before delivery. DCRs make guest OS telemetry intentional rather than automatic, helping separate security-relevant logs from lower-value performance data. section 9.4 section 9.10

Use a DCR to send different VM data to appropriate Log Analytics workspaces. This supports multihoming: performance data can go to one workspace while security events go to another, avoiding Sentinel ingestion charges for data with limited security value. section 9.1.4

Create a DCR for VM monitoring by following this sequence:

• In Azure Monitor, create a rule; choose its subscription, resource group, and platform type: Linux, Windows, or Custom. section 9.4.1
• Associate the target resources, such as Linux or Windows VMs. Selecting Azure VMs for collection automatically installs AMA; Windows 10 and 11 devices require separate AMA installation. section 9.4.1
• Select or create a data collection endpoint when needed. The endpoint must be in the same region as the connected AMA instances, so deployments spanning regions need an endpoint per region. section 9.4.1
• Add data sources and destinations, then review and create the rule. For Windows event collection, choose Windows Event Logs and select Security and System events before adding the destination. section 9.9

Filtering sensitive and unnecessary data

A transformation can filter incoming customer credit-card information so it is not stored for privacy or compliance reasons. The same mechanism can discard unneeded, non-sensitive data before it reaches a Log Analytics workspace, reducing ingestion costs. section 9.4

DCR access should be planned before deployment. Creating or editing a rule requires Monitoring Contributor on the subscription, resource group, or existing DCR; associating it with a VM requires Virtual Machine Contributor or Azure Connected Machine Resource Administrator on that resource. Template deployment also requires permissions for Microsoft.Resources/deployments actions. section 9.4

Figure 9.6 Collecting data from the guest OS using AMA and DCRs

View the relationship between the guest OS, AMA, DCRs, and the monitoring data flow. section 9.4

How Azure Security covers it

How deep it goes

Explains rule creation, resource association, regional endpoints, data sources, destinations, transformations, and required permissions without detailing transformation syntax.

Examples

Uses Linux authentication-log collection and a Windows rule collecting Security and System event logs, plus sensitive-data filtering.

What it assumes

Assumes Azure Monitor access, suitable Azure roles, and AMA-capable VMs; teaches DCR creation from the Azure portal.

What you can do after

Operate/configure a DCR that associates VMs, selects sources and destinations, and collects Windows security and system events.

How it connects

Connects Azure Monitor Agent, Log Analytics workspaces, data collection endpoints, managed identities, Windows Event Logs, and Microsoft Sentinel.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• Azure Monitor agentconfigures · The Azure Monitor agent is Microsoft's host monitoring agent that collects telemetry according to data collection rules and sends it to Azure Monitor destinations.
• Log Analyticsconfigures · Log Analytics is an Azure Monitor service and data store for collecting, retaining, querying, and analyzing logs, telemetry, and related operational data.
• data transformationconfigures · A data transformation is an operation or function that maps input data or its representation to modified data or a different representation.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.