Feb 21 2018
10:13 PM
- last edited on
Apr 07 2022
04:54 PM
by
TechCommunityAP
Feb 21 2018
10:13 PM
- last edited on
Apr 07 2022
04:54 PM
by
TechCommunityAP
Hi all,
Installed log analytics on a domain controller. Hoping to use it to build a quick dashboard for user logon and log off times.
Can we do this and can anyone point me in the right direction for the query to run?
Feb 21 2018 10:34 PM
SolutionHi,
In order to monitor security events you will need to deploy the Security & Audit solution. Keep in mind that since Ignite 2017 that solution is now part of Azure Security Center rather Log Analytics which means separate pricing. Azure Security Center uses Log Analytics platform for storing data. Once you deploy and configure Security & Audit solution there are two simple queries that you can use to see that data:
Logged off accounts:
SecurityEvent | where EventID == 4634 | sort by TimeGenerated desc
Logged on users
SecurityEvent | where EventID == 4624 | sort by TimeGenerated desc
These are single events and there are more additional events related to those. Sources:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logoff
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logon
The Security & Audit solution contains some dashboards related to logins and logoff.
You also cannot gather security logs without actually using the Security & Audit solution.
Hope this helps!
Aug 24 2018 03:04 PM
Isn't it a bit outrageous to remove SecurityEvents from the Azure Log Analytics and force the customers to purchase another solution (Security & Audit) in order to centralize logging of security related events, I mean the customer can still do it with Application and System logs.
Aug 24 2018 10:42 PM
Feb 01 2019 09:07 AM
I;m surprised that this is not all or nothing - I can see a small set of security events (eg 4663, 4985), but in no way all of them, and definitely not the 'interesting' ones. Is this simply an oversight? (In fact, 4663 is causing severe per node overage and costing us money, so I'd like to stop them being processed. Only having access to the reporting side of things, I don't know if this is even possible).
Feb 03 2019 11:21 PM
Hi,
In ASC you have 4 options for setting which events are gathered.
- All Events
- Common
- Minimal
- None
Additionally on your windows servers you can configure your audit policy in order to log only certain security events. That way ASC will gather only those that are generated.
This is expensive as you are onboarding to Azure Security Center which has many other features besides just gathering security events.
Feb 05 2019 03:38 AM
Probably a daft question, but is security event ingestion and analysis from an on premise Windows server only possible with the Standard tier, or could I get away with the free Tier?
Feb 05 2019 03:42 AM
Ingesting windows security events is part of Azure Security Center and there is no way to make that data count as regular data. Of course there is possibility of using some automation to fetch those events on your own and upload via data ingestion API but that workaround will require some substantial development.
Feb 05 2019 03:47 AM
I understand that, but I just want confirmation that I need Standard tier of Azure Security Center, and that I can't use the free Tier (of Azure Security Center).
Feb 05 2019 03:50 AM
You will need the Standard tier in ASC to use the feature. This is stated on pricing page:
https://azure.microsoft.com/en-us/pricing/details/security-center/
Security event collection and search
Mar 13 2019 03:36 AM
So having subscribed to standard tier, I still don't get those results.
A few more details. I'm monitoring three non-Azure servers, and have successfully been recording events for the past 12 months, but not logon/logoff events, which I need to have.
The subscription also contains a number of Azure servers, but I do not want OMS or security centre enabled on these.
In security center->security policy, I have turned on Standard tier, but have disabled it for the VM resource type. It is enabled for SQL Servers and App Services (but we have non of these) in this subscription.
Still no logon/logoff events.
What am I missing?
Mar 13 2019 11:47 PM
Hi,
There are two things that control what kind of security events are collected.
The first is :
I have mentioned that previously. You have to be on Common at least.
The second setting is in your servers or domain controller policy. You have to make sure that the audit policy on your computers logs logon and logoff events. If those events are present in the Windows Security event log and your setting is in Common level this would ingest logon/logoff events along with the other security events.
Mar 14 2019 08:34 AM
Turns out it was a GP issue. The engineer involved thought it was correct, but the policies in question were being overwritten. Thanks for your help anyway.
Feb 21 2018 10:34 PM
SolutionHi,
In order to monitor security events you will need to deploy the Security & Audit solution. Keep in mind that since Ignite 2017 that solution is now part of Azure Security Center rather Log Analytics which means separate pricing. Azure Security Center uses Log Analytics platform for storing data. Once you deploy and configure Security & Audit solution there are two simple queries that you can use to see that data:
Logged off accounts:
SecurityEvent | where EventID == 4634 | sort by TimeGenerated desc
Logged on users
SecurityEvent | where EventID == 4624 | sort by TimeGenerated desc
These are single events and there are more additional events related to those. Sources:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logoff
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logon
The Security & Audit solution contains some dashboards related to logins and logoff.
You also cannot gather security logs without actually using the Security & Audit solution.
Hope this helps!