How can we configure AMA agent on a VMSS to ingest data into Microsoft Sentinel?

How can we configure AMA agent on a VMSS to ingest data into Microsoft Sentinel? CliveWatson

azure

siem

solutions

Sujit_Sj

Copper Contributor

Aug 28, 2023

this will just track , while i want to ingest security logs into azure sentinel for security monitoringelieelkarkafi

elieelkarkafi

MVP

Aug 28, 2023

Sujit_Sj yes , then you need to install the data connector Windows Security Events

The Windows Security Events solution for Microsoft Sentinel allows you to ingest Security events from your Windows machines using the Windows Agent into Microsoft Sentinel. This solution includes two (2) data connectors to help ingest the logs.

Windows Security Events via AMA - This data connector helps in ingesting Security Events logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.
Security Events via Legacy Agent - This data connector helps in ingesting Security Events logs into your Log Analytics Workspace using the legacy Log Analytics agent.

Sujit_Sj
Copper Contributor
Aug 29, 2023
This is not working. We tried installing AMA agent but after installing we cannot see the agent in the machine. elieelkarkafi
- elieelkarkafi
  MVP
  Aug 30, 2023
  Sujit_Sj you have to install the agent using Azure extension framework.
  - Sujit_Sj
    Copper Contributor
    Sep 04, 2023
    we tried it is not showing any result.

Forum Discussion

How can we configure AMA agent on a VMSS to ingest data into Microsoft Sentinel?