Aug 06 2023 01:35 AM
Hello,
One of my client has multiple windows machines that has no internet but they want to forward windows event to Sentinel for monitoring. Since these machines has no internet so we can not install Arc on it (as per my understanding). Also, I found this article https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/forward-on-premises-windows-... which is somehow related to this scenario.
Will this above article helps me to achieve this or is there any other method available?
Aug 06 2023 03:53 AM - edited Aug 06 2023 03:57 AM
hello
I believe this article is very well written, I believe it works.
I found these videos that may also help you.
Another solution maybe it's to use 3rd software party, however it can be more difficult to configure like logstash.
https://www.youtube.com/watch?v=urRWkyzRI78
https://www.youtube.com/watch?v=gUOl82434Ic
https://charbelnemnom.com/windows-forwarded-events-and-microsoft-sentinel/?expand_article=1
if you liked it mark the answer with a like.
if you thought this answer helped in any way please mark it as best answer