Blog Post

Microsoft Sentinel Blog
4 MIN READ

Designs for Accomplishing Microsoft Sentinel Scalable Ingestion

Matt_Lowe's avatar
Matt_Lowe
Icon for Microsoft rankMicrosoft
Feb 13, 2023
**Thank you to the Microsoft Sentinel CxE team, Jeff Wolford, and Preeti_Krishna for the assistance with this document.**   This blog will provide a high-level overview of potential architecture ...
Updated May 16, 2023
Version 2.0
data collection
Matt_Lowe's avatar
Icon for Microsoft rankMicrosoft
Joined March 02, 2020
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

Jonhed's avatar
Jonhed
Iron Contributor
May 15, 2023

Matt_Lowe 
I am a bit confused.


Azure Load Balancer does not have round robin capabilities you mention here, with hash distribution being the closest thing.

If some log sources send significantly more logs than others, would there not be a risk of disproportionate distribution, since any logs coming from the same IP and source port will be fixed?

 

I feel like an application gateway would be better, since it can distribute via round robin, to even out the distribution.

 

Any comments would be appreciated.