Mar 11 2019 09:30 AM
Me again...
As far as I can tell, there is no (default) connector to pull in events from (on-premises) Windows Servers. However, Log Analytics can be configured to pull them in using the Windows Server agent.
Is it supported to use the Windows Server agent to add the events to the same workspace as used by Sentinel to build your own dashboard?
Haven't tested/tried yet...
-Michael
Mar 13 2019 05:59 AM