Forum Discussion

Arnaud Landry's avatar
Arnaud Landry
Brass Contributor
Nov 13, 2019

Azure Security Center - Data collection - Can't connect Windows security events

Hi,

 

when i try to configure my data collection in ASC (with a standard Tier ) the "Windows security events" is disable, i can't select an option like "None", "Minimal", "Common", "All".

 

do you have any ideas of what can be the problem ?

 

Thanks

  • Arnaud Landry's avatar
    Arnaud Landry
    Nov 14, 2019

    jsut got an answer from support, 

     

    solution is to set existing workspace to standard 

     

    so like you said : Security Center - Pricing & settings , select the destination worskpace then on the new page , choose "Standard"

     

    thanks

  • HiArnaud Landry 

    Thanks for getting in touch.

    I think the cause might be that a non-default workspace is selected. Data collection should be configured for the workspace, not the subscription.

    To do so, go to Pricing and settings, select the default workspace, and toggle the Storage account to Enabled.

    Please let us know if that resolves the issue.

    • Arnaud Landry's avatar
      Arnaud Landry
      Brass Contributor

      Hi melvynadam 

       

      when you say "go to Pricing and settings, select the default workspace, and toggle the Storage account to Enabled." it's a configuration under Azure Security center ? (settings - Data Collection ?)

       

      My current configuration is : Security Center - Pricing & settings » Settings - Data Collection » Workspace configuration : Use another workspace

       

      with a non-default workspace (i dont want to use another one but a previously create workspace)

       

      • Arnaud Landry's avatar
        Arnaud Landry
        Brass Contributor

        jsut got an answer from support, 

         

        solution is to set existing workspace to standard 

         

        so like you said : Security Center - Pricing & settings , select the destination worskpace then on the new page , choose "Standard"

         

        thanks

Resources