Data ingestion is the collection and import of security events and contextual data from multiple sources so a system can store, analyze, investigate, and respond to threats. In Microsoft Sentinel, data collection and data ingestion are used interchangeably, and collected data is stored in Log Analytics workspaces. section 8.2.1
Build an effective ingestion scope across the environment:
- Collect application, operating-system, container, and compute-resource data to provide layered visibility. section 9.1
- Collect Azure platform data, including resource operations, subscription management operations, and tenant-level service activity such as Microsoft Entra ID operations. section 9.1
- Use custom sources when required resource data cannot be collected through other data sources; APIs can support this approach. section 9.1
- Choose a Log Analytics workspace architecture deliberately: minimize workspace count unless requirements such as geographic data residency require multiple workspaces. section 8.2.1
Layered monitoring for an Azure application
A security team can ingest an application's logs together with its operating-system, container, virtual-machine, Azure resource, subscription, and tenant activity. This layered view helps detect suspicious activity and supports investigation of an incident's potential blast radius and root cause. section 9.1 section 8.2.1
Use the capability overview to connect data ingestion with threat detection, investigation, and automated response in Microsoft Sentinel. section 8.2.1
