Below is the list of blog posts with the “Microsoft Sentinel” tag.

Key takeaways Microsoft retired the Log Analytics agent (MMA) on August 31, 2024, and can shut down its cloud ingestion services at any time after March 2, 2026. The Microsoft Azure Monitor Agent (AMA) runs only on 64-bit Windows Server 2016 or later and Windows 10 1803 or later. It won’t install on Windows Server 2008, Server 2003, or any 32-bit Windows. Windows Event Forwarding (WEF) and syslog forwarders help, but each has hard limits on these hosts.

Log fan-out, also called dual-shipping, sends one copy of each event to two or more SIEMs from a single collection point. Teams do it during SIEM migrations, when an MSSP and an internal SOC both need raw events, for compliance archives, and for regional SIEMs with different regulatory scope. Do the split at the agent or at a relay. A second forwarder on every host doubles your configuration work and gives you two event counts that do not match.

Analytics Logs is Microsoft Sentinel’s full-featured tier: analytics rules, any query scope, query cost included in the ingestion price, and up to 90 days of interactive retention at no additional charge. Basic Logs cuts the ingestion price to under a quarter of Analytics, in exchange for per-GB query charges, a fixed 30-day interactive window, workspace-only query scope, and no analytics rules. Since September 2026, Basic tables support full KQL, including joins across tables.

Microsoft Sentinel charges by the gigabyte for most data you ingest into the analytics tier. To reduce Microsoft Sentinel ingest cost, drop events you never query, remove fields you don’t use, and route high-volume, low-value logs to the cheaper data lake tier. This article walks through how to do each of these with NXLog Agent configurations and KQL you can adapt for your environment. Lever Where it runs What it saves Trade-off Drop noisy events

What if you could selectively ingest only the high-quality events needed for metrics and reporting that come not only from Azure, but also from other cloud- based resources and on-site assets directly into Microsoft Sentinel? In this post, the technology we will be examining is the Azure Monitor HTTP Data Collector API, which enables clients, such as the NXLog agent, to send events to a Log Analytics workspace, making them directly accessible using Microsoft Sentinel queries.