Échangeons
← Sentinel Explorer
↳ Source GitHubSolution

Windows Security Events

Voir sur GitHub ↗Fichier original ↗

Description

The Windows Security Events solution for Microsoft Sentinel allows you to ingest Security events from your Windows machines using the Windows Agent into Microsoft Sentinel. This solution includes two (2) data connectors to help ingest the logs. 1. **Windows Security Events via AMA** - This data connector helps in ingesting Security Events logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**. 2. **Security Events via Legacy Agent** - This data connector helps in ingesting Security Events logs into your Log Analytics Workspace using the legacy Log Analytics agent.
Version
3.0.13
Auteur / éditeur déclaré
Microsoft - support@microsoft.com
Niveau de support
Microsoft

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques21
AD FS Remote Auth Sync ConnectionMediumAD FS Remote HTTP Network ConnectionMediumAD user enabled and password not set within 48 hoursLowADFS Database Named Pipe ConnectionMediumExcessive Windows Logon FailuresLowExchange OAB Virtual Directory Attribute Containing Potential WebshellHighGain Code Execution on ADFS Server via SMB + Remote Service or Scheduled TaskMediumMicrosoft Entra ID Local Device Join Information and Transport Key Registry Keys AccessMediumNew EXE deployed via Default Domain or Default Domain Controller PoliciesHighNon Domain Controller Active Directory ReplicationHighNRT Base64 Encoded Windows Process Command-linesMediumNRT Process executed from binary hidden in Base64 encoded fileMediumNRT Security Event log clearedMediumPotential Fodhelper UAC BypassMediumPotential re-named sdelete usageLowProcess Execution Frequency AnomalyMediumScheduled Task HideHighSdelete deployed via GPO and run recursivelyMediumSecurityEvent - Multiple authentication failures followed by a successLowStarting or Stopping HealthService to Avoid DetectionMediumWMI Spawning Suspicious Child Process (Living off the Land)High
Connecteurs2
Workbooks2

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
azure-sentinel-solution-securityevents
Autres fichiers source 2Solutions/Windows Security Events/Data/Solution_Windows Security Events.jsonsolution-manifest ↗Solutions/Windows Security Events/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.