Log Collection using a Log Analytics Agent from a Windows Event Collector

Question

Hi,&nbsp;To collect Security events from multiple windows hosts, a Windows Event Collector has been set up in the environment that we want to monitor. Can we forward all events from this collector using a Sentinel agent? If so, is there an additional way to filter the events forwarded, except for the standard set of options (minimal, full, recommended), for example based on original host?&nbsp;Thanks in advance!

ofer_shezaf · Answer

csmits:

Support for WEF is in private preview, to explore it and provide feedback, Join our&nbsp;Private Previews&nbsp;program.
A new generation of the Log Analtytics agent that will suppport filtering is also expected to start preview in the next few months.&nbsp;

milkmix_ · Answer

Hi&nbsp;Ofer_Shezaf&nbsp;,&nbsp;Do you have more news about WEF support ?&nbsp;I installed LA agent on a WEC server and I can retrieve events from the WEC host itself but adding other sources (ex: ForwardedEvents, custom channels from the subscriptions, ...) from `Log Analytics workspaces &gt; ... &gt; Advanced Settings &gt; Data &gt; Windows Event Logs &gt; Collect events from the following event logs` is not working. Note that ForwardedEvents is suggested in the dropdown from this blade.&nbsp;Any suggestions ?&nbsp;Best regards&nbsp;

laurent_cardon · Answer

I'm just discovering this topic and the question may be stupid...
Which use cases are we targeting using WEF collector to push info to Sentinel ? In case we have Windows Defender on the client couldn't we consider this is sufficient to guarantee the endpoint security?
Laurent&nbsp;

milkmix_ · Answer

Good point, but only works if the customer is using Microsoft EDR or an EDR at all, which is not necessarily the case for all organisations 🙂So far, most environments I see where an EDR is deployed are still centralizing "native" events in a SIEM. Other components to take into account:- auditing requirements for some cases- possibility that the EDR &#5;gets bypassed/disabled (in which case you might still detect some actions from the events)- you might have an EDR on endpoints but not on servers and you want system+services events from those (not everybody runs its workload in Azure yet ;))&nbsp;that being said, I agree with strategies like presented here&nbsp;were only curated data from Windows environments are pushed in Sentinel.

ofer_shezaf · Answer

Windows Events and EDR events have overlap but also have a distinct value. How much would naturally be specific to the EDR used. There are two primary areas in which Windows Events add value not found in EDR:

Windows events are used for logging events by many subsystems. For example, SQL server and printing would both generate Windows events.
An EDR does not report many security-related windows events. For example, typically, an EDR would not report on local user management activity.

Forum Discussion

Log Collection using a Log Analytics Agent from a Windows Event Collector

7 Replies

Resources