Merge pull request #207263 from batamig/patch-226

recreating public pr 96796

Author: PRMerger3

articles/defender-for-iot/device-builders/concept-event-aggregation.md

@@ -153,6 +153,9 @@ Defender for IoT agents aggregate events during the send interval defined in the
 
 When the agent collects similar events to the ones that are already stored in memory, the agent will increase the hit count of this specific event to reduce the memory footprint of the agent. When the aggregation time window passes, the agent sends the hit count of each type of event that occurred. Event aggregation is the aggregation of the hit counts of similar events. For example, network activity with the same remote host and on the same port, is aggregated as one event, instead of as a separate event for each packet.
 
+> [!NOTE]
+> By default, the micro agent sends logs and telemetry to the cloud for troubleshooting and monitoring purposes. This behavior can be configured or turned off through the twin.
+
 ## Next steps
 
 For more information, see:

articles/defender-for-iot/device-builders/concept-micro-agent-configuration.md

@@ -102,6 +102,13 @@ Configure the micro agent using the following collector-specific properties and
 | **Process_Mode** | `1` = Auto <br>`2` = Netlink <br>`3`= Polling | Determines the Process collector mode. In `Auto` mode, the agent first tries to enable the Netlink mode. <br><br>If that fails, it will automatically fall back / switch to the Polling mode.| `1` |
 | **Process_CacheSize** | Positive integer | The number of Process events (after aggregation) to keep in the cache between send intervals. Beyond that number, older events will be dropped (lost).| `256` |
 
+### Log collector-specific settings
+
+| Setting Name | Setting options | Description | Default |
+|--|--|--|--|
+| **LogCollector_Disabled** | `True`/`False` | Disables the Logs collector. | `False` |
+| **LogCollector_MessageFrequency** | `Low`/`Medium`/`High` | Defines the frequency in which to send Log events. | `Low` |
+
 ## Next steps
 
 For more information, see: