MicrosoftMicrosoftCurrently AMA/MMA agent provide some additional informations, about sending security logs that can be corelated in e.g. Sentinel, but not only. Real life example:
Issue: You received a Security Alert in Microsoft Defender for Cloud "Network communication with a malicious machine detected" and would like to know more about this.
In this type of findings we know only the Source VM and destination DNS/IP.
Future actions: Youu can also try to leverage Microsoft Sentinel in the future as it comes inbuilt with Threat Intelligence Indicator Feeds, DNS Event Capture and Parser as well as Windows Event logs can be captured, and this will make for an easier investigation. Via Azure Monitor Agent we can capture the datails like:
So for this kind of deep analises we still need Azure Monitor Agent and sends the logs to Log Analitics Agent (eventuallly Sentinel). Are you planning to deliver this functionality with Unified Agent? Or for this scenario AMA is still recomended?
