Security Events via Legacy Agent

Description

You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220093&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

SecurityEvents

Permissions déclarées

read and write permissions.

Workspace

Workspace

read and write permissions.

Workspace data sources

Workspace

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

1. Download and install the agent

> Security Events logs are collected only from **Windows** agents.

Choose where to install the agent:

Install agent on Azure Windows Virtual Machine

Download the agent on the relevant machine and follow the instructions.

Install agent on non-Azure Windows Machine

Select the machine to install the agent and then click **Connect**.

2. Select which events to stream

- All events - All Windows security and AppLocker events. - Common - A standard set of events for auditing purposes. - Minimal - A small set of events that might indicate potential threats. By enabling this option, you won't be able to have a full audit trail. - None - No security or AppLocker events.

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques127