Forum Discussion

Neil2020

Copper Contributor

Apr 13, 2020

Audit-Failed Events not reaching Workspace

I have a test VM in Azure and one running on my home PC, Both have the MMA agent are are sending Security Events to Sentinel's Log Analytics Workspace via ASC connector configuration, Audi-Su...

YanivSh
Apr 13, 2020
if you are seeing the event 4625 in the event viewer from one machine that sending other events i will recommend that you will open support ticket Neil2020

Neil2020

Copper Contributor

Apr 13, 2020

YanivSh see below screens:

In ASC under Pricing and Settings I have the below options:

I seem to have 1 machine residing in each:

Sentinel Workspace configuration below:

Although to clarify they are both appearing in ASC:

Appreciate the guidance

Thanks,

Neil

YanivSh

Microsoft

Apr 13, 2020

based on your pic the workspace is not define to collect security event at-all, because it is not on standard tier (paid).

please show how the sentinel security event collector define?

it must be connected and the log level must be at-least as minimal

Neil2020
Copper Contributor
Apr 13, 2020
YanivSh They are both on standard as per the pic?

Not sure what your second question means, "please show how the sentinel security event collector define?" Pretty sure I showed it as first pic in my previous post:

Thanks
Neil
- Neil2020
  Copper Contributor
  Apr 13, 2020
  @Yaniv Shasha
  
  Also for clarity, I am receiving security events from both VM's, I am not getting Audit-Failed events,
  
  Thanks,
  Neil
  - YanivSh
    Microsoft
    Apr 13, 2020
    if you are seeing the event 4625 in the event viewer from one machine that sending other events i will recommend that you will open support ticket Neil2020

Forum Discussion

Audit-Failed Events not reaching Workspace

Share

Resources