A data source is an application, service, or system that produces data for collection and analysis. In Microsoft Sentinel, selecting relevant data sources creates security visibility without automatically sending every available record to the SIEM. Data should support defined investigation and detection use cases; indiscriminate ingestion can create inefficiency and unnecessary charges. section 8.3 section 8.3.1
Common security data sources include:
- Microsoft security alerts, including Microsoft Defender for Cloud and Microsoft Defender 365. section 8.3.1
- Network security solutions, servers, endpoints, identity and access management systems, SaaS applications, threat intelligence feeds, and custom logs. section 8.3.1
- Collect through data connectors, REST API integrations, or agent-based integrations that stream logs from sources such as on-premises systems. section 8.3.1
Connect related identity activity
An employee may use the same identity for Azure resources and collaboration applications. If phishing compromises the collaboration identity, collecting SaaS and identity data alongside Azure telemetry can help connect the activity and investigate access to the Azure environment. Check Microsoft Sentinel's Data Connectors page for an existing connector; more than 100 out-of-the-box connectors cover common Microsoft and third-party sources. section 8.3.2
