Integrate on-premise windows syslog server with Sentinel

[Alistair Trigg]

Hi

Our on-premise environment is totally Windows based, no linux systems or skill and we want to integrate our Sentinel environment with our on-premise Windows syslog server - kiwi - is it possible to set up the log forwarders on a windows box rather than a linux one, as it would be the only linux vm we would have

Thanks

Alistair

[#2]

You need to setup the WEC (see lino) and deploy the AMA to that Windows Server, https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference#windows-forwarded-events-...

Also this walks you through the process https://argonsys.com/microsoft-cloud/library/forward-on-premises-windows-security-event-logs-to-micr....