Using Log Analytics workspace to record Windows VM logins.

[NathanQGE]

Hi,

Does anyone know how to use a Log Analytics workspace to record Windows VM logins. 

I have connected the workspace to the VM but this didn't 

[#2]

@NathanQGE 

Go to Log Analytics and run query

It 'looks' like you don't have the SecurityEvent table in your workspace yet - to connect this you need to point Azure Security Center - Standard (not free) to the workspace you are running that query. 

You can test the syntax in the free workspace (see link above)

https://docs.microsoft.com/en-us/azure/security-center/security-center-data-security

and 

https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-data-collection#data-c...