User Profile
WimVClapdurp
Copper Contributor
Joined 2 years ago
User Widgets
Recent Discussions
Re: MS Defender mixed licensing
Helloaleks32 Have you enabled mixed license mode also in Ms Defender for Endpoint? In defender portal (security.microsoft.com) go to settings -> endpoints -> licenses. Subscription state -> manage subscription Here you need to select the option to mixed mode. Choose what devices get plan 1 the rest will get P2 automatically. you need to create a device tag (for example MDE P1 License. Hope this can help you. Kind regards, WimHow to capture logon events from a centralized winevent log instead of the security log
Hi community, I would like to hear or find how I can get logon events from a centralize WEC (event collector server) in a winevent log. When the Sentinel AMA agent is installed it captures the security events from the WEC server security log. But I want to capture the logon events from multiple subscriptions in a defined Winevent log. So not from the security log itself from the collector server. How can I define the new log?
