Using Log Analytics workspace to record Windows VM logins.

Copper Contributor

Hi,

 

Does anyone know how to use a Log Analytics workspace to record Windows VM logins. 

I have connected the workspace to the VM but this didn't 

 

clipboard_image_0.png

1 Reply

@NathanQGE 

 

Go to Log Analytics and run query

 

It 'looks' like you don't have the SecurityEvent table in your workspace yet - to connect this you need to point Azure Security Center - Standard (not free) to the workspace you are running that query. 

 

You can test the syntax in the free workspace (see link above)

clipboard_image_0.png

https://docs.microsoft.com/en-us/azure/security-center/security-center-data-security

 

and 

 

https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-data-collection#data-c...