Private infrastructure integrations
The primary method of integration with your private infrastructure (such as an on-premises data center) is the deployment of native connectors, where supported. The next logical step is to deploy the new Azure Monitor Agent (AMA) for those services that can support it. Otherwise, the remaining on-premises services can forward their logs' Syslog servers, which act as data collectors. While endpoints can be configured to send their data to Microsoft Sentinel directly, you will likely want to centralize the management of this data flow. The key consideration for this deployment is the management of log data volume; if you are generating a large volume of data for security analytics, you will need to transmit that data over your internet connections (or private connections such as ExpressRoute).
The Syslog data collectors can be configured to reduce the load by filtering the data, but a balance must be found between the volume and velocity of data collected to have sufficient available bandwidth to send the data to Microsoft Sentinel. Investment in increased bandwidth should be considered to ensure adequate capacity based on your specific needs.
A second method of integration involves investigation and automation to carry out actions required to understand and remediate any issues found. Automation may include the deployment of Azure Automation to run scripts, or through third-party solution integration, such as a SOAR platform, depending on the resources being managed.
Keep in mind that should your private infrastructure lose connectivity to the internet, your systems will not be able to communicate with Microsoft Sentinel during the outage. Investments in redundancy and fault tolerance should be considered.
In the next section, we will discuss the pricing options for Microsoft Sentinel.
