Security Events via Legacy Agent

Description

You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220093&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

SecurityEvents

Declared permissions

read and write permissions.

Workspace

Workspace

read and write permissions.

Workspace data sources

Workspace

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

1. Download and install the agent

> Security Events logs are collected only from **Windows** agents.

Choose where to install the agent:

Install agent on Azure Windows Virtual Machine

Download the agent on the relevant machine and follow the instructions.

Install agent on non-Azure Windows Machine

Select the machine to install the agent and then click **Connect**.

2. Select which events to stream

- All events - All Windows security and AppLocker events. - Common - A standard set of events for auditing purposes. - Minimal - A small set of events that might indicate potential threats. By enabling this option, you won't be able to have a full audit trail. - None - No security or AppLocker events.

Related content

Links established from declared identifiers and solution manifests.

Analytics rules127