Forum Discussion
Log Collection using a Log Analytics Agent from a Windows Event Collector
Hi, To collect Security events from multiple windows hosts, a Windows Event Collector has been set up in the environment that we want to monitor. Can we forward all events from this collector usi...
Laurent_Cardon
Microsoft
MicrosoftI'm just discovering this topic and the question may be stupid...
Which use cases are we targeting using WEF collector to push info to Sentinel ? In case we have Windows Defender on the client couldn't we consider this is sufficient to guarantee the endpoint security?
Laurent
Ofer_ShezafMicrosoft
MicrosoftWindows Events and EDR events have overlap but also have a distinct value. How much would naturally be specific to the EDR used. There are two primary areas in which Windows Events add value not found in EDR:
- Windows events are used for logging events by many subsystems. For example, SQL server and printing would both generate Windows events.
- An EDR does not report many security-related windows events. For example, typically, an EDR would not report on local user management activity.