Module 6: Data Connectors & Ingestion Strategy
Module 5 built the workspace. This module fills it with data.
The quality of your detections is limited by the quality of your data. A workspace with one connector and no filtering produces either too little data (missed detections) or too much noise (alert fatigue). This module teaches you to build an ingestion strategy — choosing which data sources matter, connecting them reliably, filtering out noise at the point of collection, and verifying that data is flowing correctly.
Prerequisites
Complete Module 5 first. You need a working Sentinel workspace with the M365 Defender and Entra ID connectors already enabled. This module expands on that foundation with additional Microsoft connectors, third-party data sources, and Data Collection Rules.