AMA migration for Microsoft Sentinel

This article describes the migration process to the Azure Monitor Agent (AMA) when you have an existing Log Analytics Agent (MMA/OMS), and are working with Microsoft Sentinel.

Important

The Log Analytics agent will be retired on 31 August, 2024. If you are using the Log Analytics agent in your Microsoft Sentinel deployment, we recommend that you start planning your migration to the AMA.

Prerequisites

Start with the Azure Monitor documentation which provides an agent comparison and general information for this migration process.

This article provides specific details and differences for Microsoft Sentinel.

Gap analysis between agents

The following tables show gap analyses for the log types that currently rely on agent-based data collection for Microsoft Sentinel. This will be updated as support for AMA grows towards parity with the Log Analytics agent.

Windows logs

Log type / Support Azure Monitor agent support Log Analytics agent support
Security Events Windows Security Events data connector (Public preview) Windows Security Events data connector (Legacy)
Filtering by security event ID Windows Security Events data connector (AMA) (Public preview) -
Filtering by event ID Collection only -
Windows Event Forwarding Windows Forwarded Events (Public Preview) -
Windows Firewall Logs - Windows Firewall data connector
Performance counters Collection only Collection only
Windows Event Logs Collection only Collection only
Custom logs Collection only Collection only
IIS logs Collection only Collection only
Multi-homing Collection only Collection only
Application and service logs - Collection only
Sysmon Collection only Collection only
DNS logs Windows DNS servers via AMA connector (Public preview) Windows DNS Server connector (Public preview)

Important

The AMA for Windows currently has a limit of 5,000 Events Per Second (EPS). Verify whether this limit works for your organization, especially if you are using your servers as log forwarders for Windows security events or forwarded events.

Linux logs

Log type / Support Azure Monitor agent support Log Analytics agent support
Syslog Collection only Syslog data connector
Common Event Format (CEF) CEF via AMA data connector CEF data connector
Sysmon Collection only Collection only
Custom logs - Collection only
Multi-homing Collection only -

Each organization will have different metrics of success and internal migration processes. This section provides suggested guidance to consider when migrating from the Log Analytics MMA/OMS agent to the AMA, specifically for Microsoft Sentinel.

Include the following steps in your migration process:

  1. Make sure that you've considered your environmental requirements and understand the gaps between the different agents. For more information, see Migration plan considerations in the Azure Monitor documentation.

  2. Run a proof of concept to test how the AMA sends data to Microsoft Sentinel, ideally in a development or sandbox environment.

    1. To connect your Windows machines to the Windows Security Event connector, start with Windows Security Events via AMA data connector page in Microsoft Sentinel. For more information, see Windows agent-based connections.

    2. Go to the Security Events via Legacy Agent data connector page. On the Instructions tab, under Configuration > Step 2, Select which events to stream, select None. This configures your system so that you won't receive any security events through the MMA/OMS, but other data sources relying on this agent will continue to work. This step affects all machines reporting to your current Log Analytics workspace.

    Important

    Ingesting data from the same source using two different types of agents will result in double ingestion charges and duplicate events in the Microsoft Sentinel workspace.

    If you need to keep both data connectors running simultaneously, we recommend that you do so only for a limited time for a benchmarking, or test comparison activity, ideally in a separate test workspace.

  3. Measure the success of your proof of concept.

    To help with this step, use the AMA migration tracker workbook, which displays the servers reporting to your workspaces, and whether they have the legacy MMA, the AMA, or both agents installed. You can also use this workbook to view the DCRs collecting events from your machines, and which events they are collecting.

    For example:

    Screenshot of the AMA migration tracker workbook.

    Success criteria should include a statistical analysis and comparison of the quantitative data ingested by the MMA/OMS and AMA agents on the same host:

    • Measure your success over a predefined time period that represents a normal workload for your environment.

    • While testing, make sure to test each new feature provided by the AMA, such as Linux multi-homing, Windows event filtering, and so on.

    • Plan your rollout for AMA agents in your production environment according to your organization's risk profile and change processes.

  4. Roll out the new agent on your production environment and run a final test of the AMA functionality.

  5. Disconnect any data connectors that rely on the legacy connector, such as Security Events with MMA. Leave the new connector, such as Windows Security Events with AMA, running.

    While you can have both the legacy MMA/OMS and the AMA agents running in parallel, prevent duplicate costs and data by making sure that each data source uses only one agent to send data to Microsoft Sentinel.

  6. Check your Microsoft Sentinel workspace to make sure that all your data streams have been replaced using the new AMA-based connectors.

  7. Uninstall the legacy agent. For more information, see Manage the Azure Log Analytics agent .

FAQs

The following FAQs address issues specific to AMA migration with Microsoft Sentinel. For more information, see also the Frequently asked questions for AMA migration in the Azure Monitor documentation.

What happens if I run both MMA/OMS and AMA in parallel in my Microsoft Sentinel deployment?

Both the AMA and MMA/OMS agents can co-exist on the same machine. If they both send data, from the same data source to a Microsoft Sentinel workspace, at the same time, from a single host, duplicate events and double ingestion charges will occur.

For your production rollout, we recommend that you configure either an MMA/OMS agent or the AMA for each data source. To address any issues for duplication, see the relevant FAQs in the Azure Monitor documentation.

The AMA doesn’t yet have the features my Microsoft Sentinel deployment needs to work. Should I migrate yet?

The legacy Log Analytics agent will be retired on 31 August 2024.

We recommend that you keep up to date with the new features being released for the AMA over time, as it reaches towards parity with the MMA/OMS. Aim to migrate as soon as the features you need to run your Microsoft Sentinel deployment are available in the AMA.

While you can run the MMA and AMA simultaneously, you may want to migrate each connector, one at a time, while running both agents.

Next steps

For more information, see: