It can record some telemetry to help you understand why it's slow: https://learn.microsoft.com/en-us/defender-endpoint/troubles...

Microsoft Sentinel seems like a pretty unlikely candidate for SIEM to crash every machine it’s receiving data from.

Luckily the concern isn’t simply whether they could make a mistake and cause a crash by easing around in the kernel, it’s whether they’re likely to, and I’d argue that CrowdStrike is particularly likely to do so given their testing and rollout processes, and the culture that encompasses those failures

Linux: https://learn.microsoft.com/en-us/defender-endpoint/microsof...

macOS: https://learn.microsoft.com/en-us/defender-endpoint/microsof...

It does iOS and Android too.

Again, if you're an organisation big enough to care about single-pane-of-glass-monitoring you probably already have access to this via the Microsoft 365 license tier you're on.