Forum Discussion

mvanhorenbeeck's avatar
mvanhorenbeeck
MVP
Mar 11, 2019

Adding events from (on-prem) Windows Servers

Me again...

 

As far as I can tell, there is no (default) connector to pull in events from (on-premises) Windows Servers. However, Log Analytics can be configured to pull them in using the Windows Server agent.

 

Is it supported to use the Windows Server agent to add the events to the same workspace as used by Sentinel to build your own dashboard?

 

Haven't tested/tried yet...

 

-Michael

1 Reply

  • Joseph42's avatar
    Joseph42
    Copper Contributor
    Mar 13, 2019
    Yes, that's what worked for me. I actually added Sentinel to an existing workspace that had log analytics from on-premise servers, but same idea. Everything then just showed up in Sentinel.

Resources