Feb 13 2021 10:51 AM
Feb 13 2021 10:51 AM
I wonder if you can help me out? I am trying to find where to set the security event option for Windows events (All, Common, Minimal, None). The documentation states: Go to Security Center's menu in the Azure portal, select Pricing & settings, on Data Collection set the event level you need.
However when I do that all my options are greyed out.
There is a message that reads "Security Events tier configuration is shared with Azure Sentinel and was already configured there to 'Common' for the selected workspace. Please change the tier in Azure Sentinel and it will apply for Azure Security Center as well. Please note that Security events will be collected once and used in both solutions."
When I go to my Azure Sentinel workspace I cannot find where these settings are located.
Thanks in advance.
Feb 13 2021 11:20 AM - edited Feb 13 2021 11:21 AM
Hi the options are greyed out because of this :
Users of Azure Sentinel: note that security events collection within the context of a single workspace can be configured from either Azure Security Center or Azure Sentinel, but not both.
If you want to stick to Azure Security Center you have to do the following :
Disable Security Events collection in Azure Security Center (by setting Windows security events to None in the configuration of your Log Analytics agent). Then add the Security Events connector in Azure Sentinel. As with the first option, you will be able to query and analyze events in both Azure Sentinel and Azure Defender/ASC, but you will now be able to monitor the connector's connectivity status or change its configuration in - and only in - Azure Sentinel
Feb 14 2021 02:23 AM - edited Feb 14 2021 02:28 AM
Thank you for taking the time to reply to my question, appreciated!
I understand that those security event settings need to be either ASC or Sentinel and not both.
How do we instruct the client agents to use Common or All events? This is the part I'm not understanding as I cannot find where we make that 'choice' from the Sentinel blade / config pages.
If I want my client Agents to use 'common' (over all, minimal or none) - where is this defined? And how do I determine what the configuration is set to (for example, where I inherit an existing Sentinel deployment etc)
Feb 14 2021 03:44 AM - edited Feb 14 2021 03:53 AM
Hi it is defined in Security Center so you need to disable it from security center to be able to use it in Sentinel .
Disable Security event collecton in Azure Security Center
Feb 14 2021 03:55 AMSolution
Set up the Windows Security Events connector
To collect your Windows security events in Azure Sentinel:
For additional installation options and further details, see the Log Analytics agent documentation.
Select which event set (All, Common, or Minimal) you want to stream.
To use the relevant schema in Log Analytics for Windows security events, type SecurityEvent in the query window.Validate Connectivity
It may take around 20 minutes until your logs start to appear in Log Analytics.
Full documentation : Connect Windows security event data to Azure Sentinel | Microsoft Docs
Feb 14 2021 06:44 AM
@ibrahimambodji - Again, thank you for the clarification around this. Many thanks!