Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

Windows Forwarded Events

Voir sur GitHub ↗Fichier original ↗

Description

You can stream all Windows Event Forwarding (WEF) logs from the Windows Servers connected to your Microsoft Sentinel workspace using Azure Monitor Agent (AMA). This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2219963&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Statut déclaré
2
Auteur / éditeur déclaré
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

WindowsEvents

Permissions déclarées

read and write permissions.
Workspace data sources
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

Enable data collection rule​
> Windows Forwarded Events logs are collected only from **Windows** agents.

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques54
Account added and removed from privileged groupsLowAD account with Don't Expire PasswordLowADFS DKM Master Key ExportMediumAnomaly found in Network Session Traffic (ASIM Network Session schema)MediumBase64 encoded Windows process command-linesMediumCaramel Tsunami Actor IOC - July 2021HighChia_Crypto_Mining IOC - June 2021LowDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumDNS events related to mining pools (ASIM DNS Schema)LowEmail access via active syncMediumExcessive number of failed connections from a single source (ASIM Network Session schema)MediumFailed AzureAD logons but success logon to hostMediumFailed host logons but success logon to AzureADMediumFailed logon attempts by valid accounts within 10 minsLowGain Code Execution on ADFS Server via Remote WMI ExecutionMediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumGroup created then added to built in domain local or global groupMediumLumen TI IPAddress in WindowsEventsMediumMalware in the recycle binMediumMicrosoft Entra ID Health Monitoring Agent Registry Keys AccessMediumMicrosoft Entra ID Health Service Agents Registry Keys AccessMediumMidnight Blizzard - Script payload stored in RegistryMediumMidnight Blizzard - suspicious rundll32.exe execution of vbscriptMediumMultiple Password Reset by userLowMultiple RDP connections from Single SystemLowNetwork endpoint to host executable correlationMediumNetwork Port Sweep from External Network (ASIM Network Session schema)HighNew user created and added to the built-in administrators groupLowPort scan detected (ASIM Network Session schema)MediumPossible Phishing with CSL and Network SessionsMediumPotential beaconing activity (ASIM Network Session schema)LowPotential Build Process CompromiseMediumPotential KerberoastingMediumPowershell Empire Cmdlets Executed in Command LineMediumProcess executed from binary hidden in Base64 encoded fileMediumProgress MOVEIt File transfer above thresholdMediumProgress MOVEIt File transfer folder count above thresholdMediumRare RDP ConnectionsMediumRDP NestingMediumSecurity Event log clearedMediumSecurity Service Registry ACL ModificationHighSilk Typhoon New UM Service Child ProcessMediumSolorigate Named PipeHighTI Map Email entity to SecurityEventMediumTI map Email entity to SecurityEventMediumTI Map File Hash to Security EventMediumTI map File Hash to Security EventMediumTI Map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumUser account added to built in domain local or global groupLowUser account created and deleted within 10 minsMediumUser account enabled and disabled within 10 minsMedium[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
WindowsForwardedEvents
Autres fichiers source 2Solutions/Windows Forwarded Events/Data Connectors/WindowsForwardedEvents.JSONsource ↗Solutions/Windows Forwarded Events/Data/Solution_Windows Forwarded Events.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.