Blog Post

Microsoft Sentinel Blog
5 MIN READ

Revolutionizing log collection with Azure Monitor Agent

skochavi's avatar
skochavi
Icon for Microsoft rankMicrosoft
Aug 16, 2024
With the deprecation of Log analytics agent (also called MMA or OMS), it’s a great opportunity to discuss its successor – the Azure Monitor Agent or in short - (AMA), and why it is so much better and...
Updated Aug 16, 2024
Version 1.0
azure arc
cloud native siem
data collection
migration
siem
solutions
what's new
Workbooks
skochavi's avatar
Icon for Microsoft rankMicrosoft
Joined October 03, 2022
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

Ciyaresh's avatar
Ciyaresh
Brass Contributor
Aug 20, 2024

skochavi Is it possible to collect logs using the WEF connector but send it to SecurityEvent table? We did not want to onboard all of our on-prem windows servers to Azure Arc and install AMA individually as that is a lot of effort and also needs additional network configuration and potentially more resource usage due to both Arc and AMA installed on every endpoint. So instead, we deployed WEF setup and we are collecting Windows Security logs using WEF but they end up on the WindowsEvent table, not SecurityEvent.