Forum Discussion

JKatzmandu's avatar
JKatzmandu
Brass Contributor
Feb 24, 2021

Windows 2003 events in Sentinel

Hello everyone!

 

I have a customer asking me how to get Windows 2003 events into Sentinel. Obviously the MMA Sentinel Agent won't run on the host, but I'm thinking that event forwarding from 2003 to a supported system, and then scooping the logs from the supported system will work. Has anyone done this, yet?

 

Cheers!

  • Ofer_Shezaf's avatar
    Ofer_Shezaf
    Icon for Microsoft rankMicrosoft
    Feb 28, 2021
    Azure Sentinel currently doesn't support WEF, though this is planned. Meanwhile, you can use 3rd party alternatives such as NXlog to translate to Syslog or WinLogBeat and Logstash to a custom log.

Resources