Question

Your organization has 40 domain controllers that must forward security event logs to Microsoft Sentinel. To reduce the number of agents managed and to centralize collection, the SOC team wants the domain controllers to forward events to a set of dedicated Windows collector servers, and only those collectors should run the Azure Monitor Agent that sends data to the Log Analytics workspace. Which data collection approach should you configure?

Accepted Answer

Configure Windows Event Forwarding (WEF) so domain controllers forward to collector servers, then install AMA on the collectors with a DCR that collects the Forwarded Events log

Answer

Install the Azure Monitor Agent on each domain controller and use a Data Collection Rule that scopes the Windows Security event log

Answer

Deploy the legacy Log Analytics agent (MMA) on the domain controllers and enable the Security Events connector

Answer

Use the Syslog data connector with a Data Collection Rule targeting the domain controllers' Security event log