No DCR rules

[mohanrav]

[Enter feedback here] The article does not clarify if we need any Data Collection Rule needs to be configured after we migrated to new SQL Targeted AMA process. I do see a new DCR created and all the SQL machines are automatically grouped under the resources but there is no source of events configured. Could this be clarified?

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 71bbdf9c-6444-5998-1ace-038459a51d7c
• Version Independent ID: 55b6c7e7-680e-03bb-dc95-d38edfd188c2
• Content: Migrate to SQL server-targeted Azure Monitoring Agent's autoprovisioning process - Microsoft Defender for Cloud
• Content Source: articles/defender-for-cloud/defender-for-sql-autoprovisioning.md
• Service: defender-for-cloud
• GitHub Login: @dcurwin
• Microsoft Alias: dacurwin

[ManoharLakkoju-MSFT]

@mohanrav Thanks for your feedback! We will investigate and update as appropriate.

[Naveenommi-MSFT]

HI @mohanrav Thank you for your question. Based on the documentation you provided, it seems that the new SQL Targeted AMA process automatically creates a new Data Collection Rule (DCR) and groups all SQL machines under the resources. However, the documentation does not mention whether a source of events needs to be configured.

In general, a DCR specifies what data should be collected, how to transform that data, and where to send that data. It is possible that the new DCR created by the SQL Targeted AMA process already includes a source of events, or that it is not necessary to configure a source of events separately.

To confirm whether a source of events needs to be configured, I recommend checking the DCR created by the SQL Targeted AMA process and reviewing its configuration. You can also check the Azure Monitor logs to see if any data is being collected from the SQL machines. If you are still unsure, you can contact our support team via an Azure support request.

[dcurwin]

reassign:dcurwin

label:"backlog-item-created"

[mohanrav]

HI @mohanrav Thank you for your question. Based on the documentation you provided, it seems that the new SQL Targeted AMA process automatically creates a new Data Collection Rule (DCR) and groups all SQL machines under the resources. However, the documentation does not mention whether a source of events needs to be configured.

In general, a DCR specifies what data should be collected, how to transform that data, and where to send that data. It is possible that the new DCR created by the SQL Targeted AMA process already includes a source of events, or that it is not necessary to configure a source of events separately.

To confirm whether a source of events needs to be configured, I recommend checking the DCR created by the SQL Targeted AMA process and reviewing its configuration. You can also check the Azure Monitor logs to see if any data is being collected from the SQL machines. If you are still unsure, you can contact our support team via an Azure support request.

Thanks for your reply. As this is documentation gap, i'd like this to be addressed via this github request. Please reach out to the respective PG team and get this clarified. This does not qualify for a support request as there is nothing broken here to fix it. Moravind is my alias. If you'd like to have more information, you can ping on teams or email. Thank You!

[dcurwin]

please-close