Forum Discussion

ShaunHardneck's avatar
ShaunHardneck
Copper Contributor
Sep 13, 2023

Seeking Guidance on Best Practices for Ingesting Azure Diagnostics Logging into Sentinel

I'm seeking guidance on Azure Diagnostics logging. Does Microsoft provide any documentation outlining the recommended data to be ingested into Sentinel from Azure Diagnostics logging? The only information I've come across mentions that "Data ingested via Azure Diagnostics can generate a lot of noise, leading to increased Azure consumption." Are there any published best practices or recommendations on what specific data from Azure Diagnostics logging should be ingested into Sentinel?

azure
Content
Data Collection
Log Data
monitoring
Solutions
  • Rod_Trent's avatar
    Rod_Trent
    Icon for Microsoft rankMicrosoft
    Sep 13, 2023
    Most generally, you can avoid Azure Diagnostics as most of the data there is health and performance for Azure services. However, there are unique cases. For example, Azure Cognitive services (all the AI stuff) only logs to the Azure Diagnostics log right now.

Resources