Forum Discussion
Missing security events 5139, all other events are there
No problem. Basically now you are using ASC already as that functionality is under ASC now. From security center dashboard if you open Security policy blade you will see your subscriptions and your workspaces. Click on edit settings for workspace should take you to the configuration of the workspace for ASC setting. There you can set the workspace data collection settings without having to explicitly enable ASC Standard tier as well. There are two options there: pricing tier - when set to standard basically deploys the Security and Audit solution (when it was in OMS). Data collection will allow you to set the settings on events collection. Hope this helps.
Hi,
What events are collected by Azure Security Center depends on what data collection level you have set. This is described here:
https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-data-collection
Probably your ASC workspace is not configured to collect all security events.
Hello,
Thanks for your answer.
I took a look at your link and if I try to go to the Security Center, everything is greyed out and I have the message Start your free trial.
FYI, the workspace I am in was created months ago when it was still OMS but we never really used the log analytics part.
So I need to ask my admin to buy a supplemental plan to have access to the Azure Security Center ?
Sorry if my question sounds silly.
Marc
No problem. Basically now you are using ASC already as that functionality is under ASC now. From security center dashboard if you open Security policy blade you will see your subscriptions and your workspaces. Click on edit settings for workspace should take you to the configuration of the workspace for ASC setting. There you can set the workspace data collection settings without having to explicitly enable ASC Standard tier as well. There are two options there: pricing tier - when set to standard basically deploys the Security and Audit solution (when it was in OMS). Data collection will allow you to set the settings on events collection. Hope this helps.
Thanks again for your help, it is perfectly working now.
Marc
