Implement activity and event collection in Microsoft Sentinel - Part 2

Following our introduction to Microsoft Sentinel workspaces, content management, and Microsoft service connectors, Part 2 moves deeper into activity and event collection from infrastructure and third-party security systems.

Led by Musbau Olagunju, Senior Security Engineer, this session will focus on collecting Syslog, Common Event Format (CEF), and Windows security events in Microsoft Sentinel—core skills for building comprehensive SIEM visibility across hybrid and multicloud environments.

A SIEM is only as effective as the security telemetry available to it. Organizations typically operate a mixture of Windows servers, Linux systems, network appliances, firewalls, security products, and cloud workloads.

Microsoft Sentinel provides mechanisms for bringing these different event sources into a centralized security analytics platform.

This session will focus on three important ingestion scenarios: Syslog, CEF, and Windows Security Events.

Practical Learning Outcomes

By the end of this session, participants should be able to:

• Explain how Microsoft Sentinel ingests security telemetry from different infrastructure sources.
• Understand the roles of Syslog and CEF in security event collection.
• Configure Syslog-based event collection for supported systems and devices.
• Understand how third-party security products can send CEF events to Sentinel.
• Configure Windows Security Event collection.
• Understand how Azure Monitor Agent and Data Collection Rules support event collection.
• Validate whether security events are successfully reaching Microsoft Sentinel.
• Query collected events using Kusto Query Language (KQL).
• Design a more comprehensive event-collection strategy for hybrid security operations.

Who Should Attend?

This session is particularly relevant to SOC Analysts, Security Engineers, Microsoft Sentinel Engineers, Cloud Security Engineers, Azure Administrators, SIEM Engineers, Incident Responders, Threat Hunters, Security Architects, infrastructure engineers, and professionals developing practical Microsoft security skills.

It will also benefit anyone learning how to design or operate a SOC where Microsoft Sentinel must ingest telemetry from Windows, Linux, network appliances, security devices, and third-party platforms.

Connect the data. Centralize the visibility. Detect the threats.

Learn | Connect | Grow | Secure