Windows Forwarded Events connector with Windows Security Events NRT rules

I've seen this done before, although I wasn't the one who originally set it up. I know it's possible, but I haven't found any official documentation describing the process.

If I were approaching it, I'd first get the WEF collection working normally and verify that the expected events are being collected. Once that path is working, I'd update the DCR to send the data to the SecurityEvent table instead.

Comparing the published schemas, only two differences really stand out. Provider should be renamed to EventSourceName, and EventData should be converted from dynamic to string. I'd start with the minimal transformation below and only make additional schema changes if validation or ingestion indicates they're necessary.

source | project-rename EventSourceName = Provider | extend EventData = tostring(EventData)

I'd be interested to hear if anyone has tried this recently and whether there are any additional adjustments required with the current AMA/DCR implementation.