Get in touch
← Sentinel Explorer
↳ GitHub sourceSolution

Windows Security Events

View on GitHub ↗Original file ↗

Description

The Windows Security Events solution for Microsoft Sentinel allows you to ingest Security events from your Windows machines using the Windows Agent into Microsoft Sentinel. This solution includes two (2) data connectors to help ingest the logs. 1. **Windows Security Events via AMA** - This data connector helps in ingesting Security Events logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**. 2. **Security Events via Legacy Agent** - This data connector helps in ingesting Security Events logs into your Log Analytics Workspace using the legacy Log Analytics agent.
Version
3.0.13
Declared author / publisher
Microsoft - support@microsoft.com
Support tier
Microsoft

Related content

Links established from declared identifiers and solution manifests.

Analytics rules21
AD FS Remote Auth Sync ConnectionMediumAD FS Remote HTTP Network ConnectionMediumAD user enabled and password not set within 48 hoursLowADFS Database Named Pipe ConnectionMediumExcessive Windows Logon FailuresLowExchange OAB Virtual Directory Attribute Containing Potential WebshellHighGain Code Execution on ADFS Server via SMB + Remote Service or Scheduled TaskMediumMicrosoft Entra ID Local Device Join Information and Transport Key Registry Keys AccessMediumNew EXE deployed via Default Domain or Default Domain Controller PoliciesHighNon Domain Controller Active Directory ReplicationHighNRT Base64 Encoded Windows Process Command-linesMediumNRT Process executed from binary hidden in Base64 encoded fileMediumNRT Security Event log clearedMediumPotential Fodhelper UAC BypassMediumPotential re-named sdelete usageLowProcess Execution Frequency AnomalyMediumScheduled Task HideHighSdelete deployed via GPO and run recursivelyMediumSecurityEvent - Multiple authentication failures followed by a successLowStarting or Stopping HealthService to Avoid DetectionMediumWMI Spawning Suspicious Child Process (Living off the Land)High
Connectors2
Workbooks2

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
azure-sentinel-solution-securityevents
Additional source files 2Solutions/Windows Security Events/Data/Solution_Windows Security Events.jsonsolution-manifest ↗Solutions/Windows Security Events/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.