Windows Forwarded Events
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | WindowsForwardedEvents |
| Publisher | Microsoft |
| Used in Solutions | Windows Forwarded Events |
| Collection Method | AMA |
| Connector Definition Files | WindowsForwardedEvents.JSON |
| Microsoft Learn | View on Learn |
You can stream all Windows Event Forwarding (WEF) logs from the Windows Servers connected to your Microsoft Sentinel workspace using Azure Monitor Agent (AMA).
This connection enables you to view dashboards, create custom alerts, and improve investigation.
This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2219963&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
WindowsEvent |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace data sources (Workspace): read and write permissions.
Custom Permissions:
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Enable data collection rule
- Configure WindowsForwardedEvents data connector
- Create data collection rule
- Install/configure: OpenCustomDeploymentBlade
Windows Forwarded Events logs are collected only from Windows agents.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊