Windows Security Events via AMA
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
| Attribute | Value |
|---|---|
| Connector ID | WindowsSecurityEvents |
| Publisher | Microsoft |
| Used in Solutions | Windows Security Events |
| Collection Method | AMA |
| Connector Definition Files | template_WindowsSecurityEvents.JSON |
You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the Microsoft Sentinel documentation.
Additional Information
- 📖 Related Documentation: Windows security event sets reference - Lists Windows security event IDs for Minimal, Common, and All event sets
- 📖 Setup Guide: Windows security events via AMA - Collect Windows security events using Azure Monitor Agent
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
SecurityEvent |
✓ | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions: - Workspace data sources (Workspace): read and write permissions.
Custom Permissions:
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Enable data collection rule
Security Events logs are collected only from Windows agents. - Configure WindowsSecurityEvents data connector
- Create data collection rule
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊