5.2. Implement Activity and Event Collection in Microsoft Sentinel

💡 First Principle: Detection is only as good as the data feeding it — Sentinel can't correlate signals it never ingested, which is why the mechanics of getting data in (workspaces, connectors, collection rules) are as much a tested exam skill as anything you'd do with the data once it arrives.

Mental model: picture Sentinel as a funnel with a workspace at the bottom, data connectors feeding in from every direction (Azure resources, on-premises syslog, Windows Security events, third-party sources), and automation on the output side turning correlated incidents into action.

⚠️ Common Misconception: Automation rules and playbooks are not the same feature. Automation rules define the triggering conditions and orchestration order for how an incident should be handled; playbooks (built on Logic Apps) are the actual automated actions that get executed — a single rule can invoke multiple playbooks in sequence.