Blog Post

Microsoft Sentinel Blog
8 MIN READ

Create, Edit, and Monitor Data Collection Rules with the Data Collection Rule Toolkit

Matt_Lowe's avatar
Matt_Lowe
Icon for Microsoft rankMicrosoft
May 02, 2023
*Thank you to Jing Nghik for assisting with the creation of this toolkit and to the Customer Connection Program for testing this solution.*   *This is going to be a long blog. I recommend reading...
Updated May 02, 2023
Version 3.0
best practices
data collection
Workbooks
Matt_Lowe's avatar
Icon for Microsoft rankMicrosoft
Joined March 02, 2020
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

piovisqui's avatar
piovisqui
Copper Contributor
Mar 04, 2024

Hi.

 

This is a very good Workbook to help understand Azure Data Collector, I have used it many times.

 

I'm trying to use the Windows DCR to get more events than just inside Security (NSA Recommended Event IDs, MITRE Tactic Alignment, Recommended Event IDs).
When I create the DCR the code is fixed to only include security, however the Workbook mentions events outside it. 

For example, the workbook suggests Event ID 5859 from Microsoft-Windows-WMI-Activity, however it only creates the filter with "Security!*[System[(EventID=xxxx)".

 

Is there a way to fix this? Or am I doing something wrong?