You have an Azure subscription that contains 100 Linux virtual machines.

To collect event logs from Linux virtual machines in Microsoft Sentinel, the data ingestion path must be correctly configured through Azure Monitor (Log Analytics) and Sentinel connectors . The correct order of actions is as follows:

1️ ⃣ Add Microsoft Sentinel to a workspace:

Sentinel requires a Log Analytics workspace as its data foundation. You must first enable Microsoft Sentinel on a workspace by selecting Microsoft Sentinel → Add → Select workspace . This step prepares the workspace to receive and analyze security data.

2️ ⃣ Add a Syslog connector to the workspace:

Linux systems send event data through Syslog . You must enable the Syslog connector within the Sentinel workspace. The connector d efines which Syslog facilities and severities should be collected and ingested into Sentinel. It acts as the integration bridge between the Linux hosts and Sentinel’s analytics engine.

3️ ⃣ Install the Log Analytics agent for Linux on the virtual machines:

To forward the logs, each Linux virtual machine needs the Log Analytics agent (OMS agent) . This agent collects the configured Syslog and performance data and sends it to the connected Log Analytics workspace.

This sequence ensures proper setup for Linux lo g ingestion: Sentinel is first activated, then the Syslog data source is configured, and finally, agents are deployed to gather and transmit the logs.