Security Center collects data from your Azure virtual machines (VMs), virtual machine scale sets, IaaS containers, and non-Azure (including on-premises) machines to monitor for security vulnerabilities and threats.
Data is collected using:
The Log Analytics agent, which reads various security-related configurations and event logs from the machine and copies the data to your workspace for analysis. Examples of such data are: operating system type and version, operating system logs (Windows event logs), running processes, machine name, IP addresses, and logged in user.
Security extensions, such as the Azure Policy Add-on for Kubernetes, which can also provide data to Security Center regarding specialized resource types.
Reference:
https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-data-collection

* Table1 - Yes, Table2 - No
Basic Plan: Data is interactive for 30 days at a lower cost, optimized for single-table queries (troubleshooting/incidents).
* Table3 - Yes, Table4 - Yes
Analytics Plan: Data is interactive for 4-730 days (default 30-90 days), ideal for real-time analytics, with full KQL support.
Reference:
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/search-jobs

Attack Surface Reduction rules.
Block all Office applications from creating child processes
Block executable content from email client and webmail
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface- reduction-rules-reference?view=o365-worldwide

To identify MITRE ATT&CK tactics and techniques for a multi-stage attack with minimal effort in Microsoft Sentinel, use the built-in MITRE coverage feature within the Microsoft Defender portal.
This provides a visual matrix mapping active, low-fidelity alerts to specific techniques, enabling rapid understanding of the attack chain without manual, complex investigation.
Action: Navigate to Threat management > MITRE ATT&CK within the Sentinel/Defender portal.
Identify Techniques: Use the matrix visualization to see which techniques are active in your workspace.
Analyze Details: Click on a specific technique in the matrix to open a pane with detailed information and direct links to related hunting queries or incidents.
Alternative (Advanced): Ensure the Advanced multistage attack detection (Fusion) rule is enabled (default) to automatically correlate multiple alerts across products into high-fidelity incidents.
Actionable View: Use the "View full technique details" to understand the attacker's intent as categorized by the MITRE ATT&CK framework.
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage