Question

Your organization uses Microsoft Sentinel and wants to collect Windows Security event logs from about 400 domain-joined servers. You need to ingest only specific event IDs (such as 4624, 4625, and 4688) to control ingestion costs, and you want a modern, agent-based approach that Microsoft recommends going forward. Which configuration should you implement?

Accepted Answer

Deploy the Windows Security Events via AMA connector and create a Data Collection Rule with a custom XPath filter targeting the required event IDs

Answer

Deploy the Security Events connector using the legacy Log Analytics agent (MMA) and select the 'Common' collection tier

Answer

Configure Windows Event Forwarding (WEF) to a collector server and forward all Security events to Sentinel with no filtering

Answer

Enable the Azure Activity connector and create an analytics rule to filter for the required event IDs after ingestion