Security telemetry
Security telemetry is event data and measurements collected from systems, applications, identities, and networks to help monitor and investigate security-relevant activity.
Logs are one kind of telemetry
An audit event can record a permission change. A network measurement can show traffic volume. A trace can connect parts of an application request. OpenTelemetry distinguishes logs, metrics, and traces; security teams can use such observations alongside data from security products.
Microsoft Sentinel’s connector documentation shows how data from different services enters a monitoring platform. Installing a connector is only part of the work: the required source events must exist, arrive, and retain the fields needed for the question being asked.
Collection and detection are separate
A system can collect an event without producing an alert. A useful detection needs logic that interprets the relevant data; a response needs someone or something to act on the result. SOC scenario visibility follows those stages separately.
For an investigation into a sensitive file read, useful fields include the acting identity, resource, operation, result, and usable timestamps. Check that those fields reach the monitoring platform before relying on it to answer the question. The technical follow-on guide applies this to planned security tests.
Too little detail leaves questions unanswered; collecting everything creates its own storage, privacy, and analysis burden. Choose the fields and retention that support the intended use, and restrict sensitive data appropriately.
When records disagree, examine their meaning and collection timing before joining them into a story. Reading sign-in evidence helps separate authentication records from the later application activity they cannot establish on their own.