Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Collect logs from text files with the Azure Monitor Agent and ingest to Microsoft Sentinel

4 September 2026Doc update+14 / −7 lines

In brief

The article adds Azure and Defender portal steps for creating data collection rules, warns not to edit automatically populated transformations for listed applications or devices, and documents ARM-based setup tooling.

What Defender admins need to know

Administrators configuring the connector should follow the updated steps and preserve automatically populated transformations.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Collect logs from text files with the Azure Monitor Agent and ingest to Microsoft Sentinel

This article describes how to use the Custom Logs via AMA connector to quickly filter and ingest logs in text-file formatlogs. These logs come from network or security applications installed on Windows or Linux machines. Before you configureset up the connector, review the Prerequisites section. That section forcovers required permissions, supported machines, and agent installation requirements.installation.

Many applications log data to text files instead of standard logging services like Windows Event log or Syslog. You can use the Azure Monitor Agent (AMA) to collect data infrom text files of nonstandard formats fromon both Windows and Linux computers. The AMA can also effect transformations ontransform the data at the time of collection,during collection to parse it into different fields.

For more information about the applications for which Microsoft Sentinel has solutions to support log collection, see Custom Logs via AMA data connector - Configure data ingestion to Microsoft Sentinel from specific applications.

Azure or Defender portal

Use the following steps in the Azure or Defender portal to create and configure the data collection rule.

Create data collection rule (DCR)

To get started, open either the Custom Logs via AMA data connector in Microsoft Sentinel and create a data collection rule (DCR).

Configure the DCR for your application

    1. In the Collect tab, select your application or device type from the Select device type (optional) drop-down box, or leave it as Custom new table if your application or device isn't listed.

    2. If you chose one of the listed applications or devices, the Table name field is automatically populated with the right table name. If you chose Custom new table, enter a table name under Table name. The name must end with the _CL suffix.

    3. In the Transform field, if you chose a custom new table in step 1, enter a Kusto query that applies a transformation of your choice to the data.

      If you chose one of the listed applications or devices in step 1, the Transform field is automatically populated with the proper transformation. DO NOT edit the transformation that appears there. Depending on the chosen type, the Transform field value should be one of the following:

      • source (the default—no transformation)
      • source | project-rename Message=RawData (for devices that send logs to a forwarder)

    Resource Manager template

    InUse this option to install the Collect tab, select your application or device type fromagent and create the Select device type (optional) drop-down box, or leave it as Custom new table if your application or device isn't listed.

  2. If you chose one of the listed applications or devices, the Table name field is automatically populateddata collection rule with the right table name. If you chose Custom new table, enter a table name under Table name. The name must end with the _CL suffix.ARM-based tooling.

  3. In the Transform field, if you chose a custom new table in step 1, enter a Kusto query that applies a transformation of your choice to the data.

    If you chose one of the listed applications or devices in step 1, the Transform field is automatically populated with the proper transformation. DO NOT edit the transformation that appears there. Depending on the chosen type, this value should be one of the following:

    • source (the default—no transformation)
    • source | project-rename Message=RawData (for devices that send logs to a forwarder)

Resource Manager template

Install the Azure Monitor Agent

Follow the appropriate instructions from the Azure Monitor documentation to install the Azure Monitor Agent on the machine hosting your application, or on your log forwarder. Use the Windows instructions if the machine runs Windows, or the Linux instructions if it runs Linux.

Configure the security device or appliance

For specific instructions to configureTo set up your security application or appliance, see Custom Logs via AMA data connector - Configure data ingestion to Microsoft Sentinel from specific applications.

ContactIf the product docs don't cover your device, contact the solution provider for more information, or if the product documentation doesn't include instructions for your appliance or device.help.

Related content