Adding events from (on-prem) Windows Servers

[Michael Van Horenbeeck]

Me again...

As far as I can tell, there is no (default) connector to pull in events from (on-premises) Windows Servers. However, Log Analytics can be configured to pull them in using the Windows Server agent.

Is it supported to use the Windows Server agent to add the events to the same workspace as used by Sentinel to build your own dashboard?

Haven't tested/tried yet...

-Michael

[#2]

Yes, that's what worked for me. I actually added Sentinel to an existing workspace that had log analytics from on-premise servers, but same idea. Everything then just showed up in Sentinel.