Question

Your SOC uses Microsoft Sentinel with the Azure Monitor Agent (AMA) deployed to 200 Windows servers. You created a data collection rule (DCR) that filters Security event logs to collect only common events. After deployment, you notice that a subset of 40 servers is still not sending any Security events to the workspace, even though the AMA is healthy and reporting heartbeats. What is the most likely cause?

Accepted Answer

The 40 servers are not associated with the data collection rule via a data collection rule association (DCRA).

Answer

The workspace data retention period is set too low, causing the events to be dropped on ingestion.

Answer

The Security event log requires the legacy Microsoft Monitoring Agent (MMA), which cannot coexist with AMA on the same host.

Answer

The DCR transformation is discarding the events because entity mapping was not configured in the rule.