{
    "id": "WindowsForwardedEvents",
    "title": "Windows Forwarded Events",
    "publisher": "Microsoft",
    "descriptionMarkdown": "You can stream all Windows Event Forwarding (WEF) logs from the Windows Servers connected to your Microsoft Sentinel workspace using Azure Monitor Agent (AMA).\n\tThis connection enables you to view dashboards, create custom alerts, and improve investigation.\n\tThis gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2219963&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "WindowsEvents",
            "baseQuery": "WindowsEvent"
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "WindowsEvent\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "WindowsForwardedEvents",
            "value": null
        }
    ],
    "dataTypes": [
        {
            "name": "WindowsEvents",
            "lastDataReceivedQuery": "WindowsEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false,
        "featureFlag": {
            "feature": "WindowsForwardedEventsFeature",
            "featureStates": {
                "1": 2,
                "2": 2,
                "3": 2,
                "4": 2,
                "5": 2
            }
        }
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces/datasources",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace data sources",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true
                }
            }
        ],
        "customs": [
            {
                "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Enable data collection rule​",
            "description": ">  Windows Forwarded Events logs are collected only from **Windows** agents.",
            "instructions": [
                {
                    "type": "WindowsForwardedEvents"
                },
                {
                    "parameters": {
                        "linkType": "OpenCreateDataCollectionRule",
                        "dataCollectionRuleType": 1
                    },
                    "type": "InstallAgent"
                },
                {
                    "parameters": {
                        "linkType": "OpenCustomDeploymentBlade",
                        "dataCollectionRuleType": 1
                    },
                    "type": "InstallAgent"
                }
            ]
        }
    ]
}