Forward On-Premises Windows Security Event Logs to Microsoft Sentinel

Ciyaresh 

Thanks for responding.

• Did you create a data collection rule through Windows Forwarded Events connector? 

>>> Yes, I selected security events in the DCR and filtered with some custom event IDs. However, I've tried selecting All events too but the WindowsEvents table shows empty.

• Did you verify that your WEF setup works? Checking the event viewer on the VM that is suppose to receive forwarded events

>>> The WEF shows forwarded events on the event viewer. It is just not showing up on Sentinel in the WindowsEvents table.

The setup is exactly the same in this tutorial guide. Just don't know what I might be missing on sentinel.