Nov 13 2019 10:56 AM - last edited on Nov 29 2021 09:20 AM by Allen
when i try to configure my data collection in ASC (with a standard Tier ) the "Windows security events" is disable, i can't select an option like "None", "Minimal", "Common", "All".
do you have any ideas of what can be the problem ?
Nov 14 2019 08:26 AM
Thanks for getting in touch.
I think the cause might be that a non-default workspace is selected. Data collection should be configured for the workspace, not the subscription.
To do so, go to Pricing and settings, select the default workspace, and toggle the Storage account to Enabled.
Please let us know if that resolves the issue.
Nov 14 2019 12:13 PM
when you say "go to Pricing and settings, select the default workspace, and toggle the Storage account to Enabled." it's a configuration under Azure Security center ? (settings - Data Collection ?)
My current configuration is : Security Center - Pricing & settings » Settings - Data Collection » Workspace configuration : Use another workspace
with a non-default workspace (i dont want to use another one but a previously create workspace)
Nov 14 2019 01:33 PMSolution
jsut got an answer from support,
solution is to set existing workspace to standard
so like you said : Security Center - Pricing & settings , select the destination worskpace then on the new page , choose "Standard"