Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Windows Security Events via AMA

View on GitHub ↗Original file ↗

Description

You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220225&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Declared status
2
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

SecurityEvents

Declared permissions

read and write permissions.
Workspace data sources
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Enable data collection rule​
> Security Events logs are collected only from **Windows** agents.

Related content

Links established from declared identifiers and solution manifests.

Analytics rules108
Account added and removed from privileged groupsLowAD account with Don't Expire PasswordLowAD FS Remote Auth Sync ConnectionMediumAD FS Remote HTTP Network ConnectionMediumAD user enabled and password not set within 48 hoursLowADFS Database Named Pipe ConnectionMediumADFS DKM Master Key ExportMediumAnomaly found in Network Session Traffic (ASIM Network Session schema)MediumBase64 encoded Windows process command-linesMediumCertified Pre-Owned - backup of CA private key - rule 1MediumCertified Pre-Owned - backup of CA private key - rule 2MediumCertified Pre-Owned - TGTs requested with certificate authenticationMediumCredential Dumping Tools - File ArtifactsHighCredential Dumping Tools - Service InstallationHighDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumDetecting Macro Invoking ShellBrowserWindow COM ObjectsMediumDev-0270 Malicious Powershell usageHighDEV-0270 New User CreationHighDev-0270 Registry IOC - September 2022HighDev-0270 WMIC DiscoveryHighDumping LSASS Process Into a FileHighEatonForeseer - Unauthorized LoginsHighEmail access via active syncMediumExcessive number of failed connections from a single source (ASIM Network Session schema)MediumExcessive share permissionsMediumExcessive Windows Logon FailuresLowExchange OAB Virtual Directory Attribute Containing Potential WebshellHighFailed AzureAD logons but success logon to hostMediumFailed host logons but success logon to AzureADMediumFailed logon attempts by valid accounts within 10 minsLowGain Code Execution on ADFS Server via Remote WMI ExecutionMediumGain Code Execution on ADFS Server via SMB + Remote Service or Scheduled TaskMediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumGroup created then added to built in domain local or global groupMediumIdentify SysAid Server web shell creationHighLateral Movement via DCOMMediumLumen TI IPAddress in SecurityEventsMediumMalware in the recycle binMediumMicrosoft Entra ID Health Monitoring Agent Registry Keys AccessMediumMicrosoft Entra ID Health Service Agents Registry Keys AccessMediumMicrosoft Entra ID Local Device Join Information and Transport Key Registry Keys AccessMediumMidnight Blizzard - Script payload stored in RegistryMediumMidnight Blizzard - suspicious rundll32.exe execution of vbscriptMediumMultiple Password Reset by userLowMultiple RDP connections from Single SystemLowNetwork endpoint to host executable correlationMediumNetwork Port Sweep from External Network (ASIM Network Session schema)HighNew EXE deployed via Default Domain or Default Domain Controller PoliciesHighNew user created and added to the built-in administrators groupLowNon Domain Controller Active Directory ReplicationHighNRT Base64 Encoded Windows Process Command-linesMediumNRT Process executed from binary hidden in Base64 encoded fileMediumNRT Security Event log clearedMediumPort scan detected (ASIM Network Session schema)MediumPossible Phishing with CSL and Network SessionsMediumPotential beaconing activity (ASIM Network Session schema)LowPotential Build Process CompromiseMediumPotential Fodhelper UAC BypassMediumPotential KerberoastingMediumPotential re-named sdelete usageLowPotential Remote Desktop TunnelingMediumPowershell Empire Cmdlets Executed in Command LineMediumProcess executed from binary hidden in Base64 encoded fileMediumProcess Execution Frequency AnomalyMediumPROD (TM001.1) - GROUP - Added to Group Outside the Object Tier LevelHighPROD (TM002.1) - OBJECT - Created or Deleted a Tier Level ObjectLowPROD (TM003.1) - OBJECT - Moved or Recovered a Tier Level AccountMediumPROD (TM004.1) - OBJECT - Enabled, Disabled, Unlocked, or Password Reset of a Tier Level ObjectHighPROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OUHighPROD (TM006.1) - ACL - Modified at Tier Level OUHighPROD (TM007.1) - OU - Created or Deleted at Tier LevelHighPROD (TM008.1) - GPO - Linked, Unlinked, or Enforced at Root of DomainHighPROD (TM009.1) - ACL - Modified at Root of the DomainHighPROD (TM010.1) - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer ObjectInformationalPROD (TM011.1) - LAPS - Tier Level Computer Object LAPS Password Expiration Time Set ManuallyLowPROD (TM012.1) - GPO - Enforced Outside of Tier ModelHighPROD (TM013.1) - OU - Block Inheritance was Enabled on an OUHighPROD (TM014.1) - GPO - Linked, Unlinked, or Enforced at the AD Site LevelHighPROD (TM015.1) - ACL - Modified at KRBTGT or AdminSDHolder Object LevelHighPROD (TM016.1) - GROUP - Added to Well-Known or Tier Model GroupHighPROD (TM017.1) - GROUP - Tier 0 Added to Allow RODC Password Replication GroupHighPROD (TM018.1) - DOMAIN - Child Domain promoted within the ForestHighPROD (TM019.1) - TRUST - A new AD Trust has been establishedHighRare RDP ConnectionsMediumRDP NestingMediumRegistry Persistence via AppCert DLL ModificationMediumRegistry Persistence via AppInit DLLs ModificationMediumScheduled Task HideHighSdelete deployed via GPO and run recursivelyMediumSecurity Event log clearedMediumSecurity Service Registry ACL ModificationHighSecurityEvent - Multiple authentication failures followed by a successLowSilk Typhoon New UM Service Child ProcessMediumSolorigate Named PipeHighStarting or Stopping HealthService to Avoid DetectionMediumTI Map Email entity to SecurityEventMediumTI map Email entity to SecurityEventMediumTI Map File Hash to Security EventMediumTI map File Hash to Security EventMediumUser account added to built in domain local or global groupLowUser account created and deleted within 10 minsMediumUser account enabled and disabled within 10 minsMediumWDigest downgrade attackMediumWindows Binaries Executed from Non-Default DirectoryMediumWindows Binaries Lolbins RenamedMediumZinc Actor IOCs files - October 2022High[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1
Workbooks11

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
WindowsSecurityEvents
Additional source files 2Solutions/Windows Security Events/Data Connectors/template_WindowsSecurityEvents.JSONsource ↗Solutions/Windows Security Events/Data/Solution_Windows Security Events.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.