How to forward evtx files to azure sentinel

Question

Hi&nbsp;I want to sent evtx sample files to azure sentinel log analytics workspace. Can azure sentinel support winlogbeat. If not whats the easy solution to perform this.GitHub - sbousseaden/EVTX-ATTACK-SAMPLES: Windows Events Attack SamplesThese are logs i want to sent.&nbsp;

garybushey · Answer

le0li9ht&nbsp;Aren't these Windows Event logs?&nbsp; Can't you import them using the Microsoft Monitoring agent directly from the Event Hub?&nbsp;

le0li9ht · Answer

GaryBushey&nbsp; can you provide any resource for doing the same plz. Very new to event hubs

garybushey · Answer

le0li9ht&nbsp;Not an Azure Event Hub but rather the Microsoft Monitor agent allows you to gather events from windows computers.&nbsp; &nbsp;By default, only the Security event log will be ingested (with the Security Events data connector enabled), but if you go into Settings =&gt; Workspace Settings =&gt; Agents configuration&nbsp; you can add other Windows event logs that you want to ingest, like Application, Setup, and System.

le0li9ht · Answer

GaryBushey&nbsp;I want to clarify one thing here that i dont want my windows system event logs to be sent out to azure sentinel. I want to send only those event log files which are from github repo. only those. Is that possible with the solution you provided me with.

le0li9ht · Answer

Any update on this?

Forum Discussion

How to forward evtx files to azure sentinel

Share

Resources