Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Windows Forwarded Events

View on GitHub ↗Original file ↗

Description

You can stream all Windows Event Forwarding (WEF) logs from the Windows Servers connected to your Microsoft Sentinel workspace using Azure Monitor Agent (AMA). This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2219963&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Declared status
2
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

WindowsEvents

Declared permissions

read and write permissions.
Workspace data sources
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Enable data collection rule​
> Windows Forwarded Events logs are collected only from **Windows** agents.

Related content

Links established from declared identifiers and solution manifests.

Analytics rules54
Account added and removed from privileged groupsLowAD account with Don't Expire PasswordLowADFS DKM Master Key ExportMediumAnomaly found in Network Session Traffic (ASIM Network Session schema)MediumBase64 encoded Windows process command-linesMediumCaramel Tsunami Actor IOC - July 2021HighChia_Crypto_Mining IOC - June 2021LowDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumDNS events related to mining pools (ASIM DNS Schema)LowEmail access via active syncMediumExcessive number of failed connections from a single source (ASIM Network Session schema)MediumFailed AzureAD logons but success logon to hostMediumFailed host logons but success logon to AzureADMediumFailed logon attempts by valid accounts within 10 minsLowGain Code Execution on ADFS Server via Remote WMI ExecutionMediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumGroup created then added to built in domain local or global groupMediumLumen TI IPAddress in WindowsEventsMediumMalware in the recycle binMediumMicrosoft Entra ID Health Monitoring Agent Registry Keys AccessMediumMicrosoft Entra ID Health Service Agents Registry Keys AccessMediumMidnight Blizzard - Script payload stored in RegistryMediumMidnight Blizzard - suspicious rundll32.exe execution of vbscriptMediumMultiple Password Reset by userLowMultiple RDP connections from Single SystemLowNetwork endpoint to host executable correlationMediumNetwork Port Sweep from External Network (ASIM Network Session schema)HighNew user created and added to the built-in administrators groupLowPort scan detected (ASIM Network Session schema)MediumPossible Phishing with CSL and Network SessionsMediumPotential beaconing activity (ASIM Network Session schema)LowPotential Build Process CompromiseMediumPotential KerberoastingMediumPowershell Empire Cmdlets Executed in Command LineMediumProcess executed from binary hidden in Base64 encoded fileMediumProgress MOVEIt File transfer above thresholdMediumProgress MOVEIt File transfer folder count above thresholdMediumRare RDP ConnectionsMediumRDP NestingMediumSecurity Event log clearedMediumSecurity Service Registry ACL ModificationHighSilk Typhoon New UM Service Child ProcessMediumSolorigate Named PipeHighTI Map Email entity to SecurityEventMediumTI map Email entity to SecurityEventMediumTI Map File Hash to Security EventMediumTI map File Hash to Security EventMediumTI Map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumUser account added to built in domain local or global groupLowUser account created and deleted within 10 minsMediumUser account enabled and disabled within 10 minsMedium[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
WindowsForwardedEvents
Additional source files 2Solutions/Windows Forwarded Events/Data Connectors/WindowsForwardedEvents.JSONsource ↗Solutions/Windows Forwarded Events/Data/Solution_Windows Forwarded Events.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.