You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
When logs are collected by WEC (i.e. forwarded via a Windows Server) the security logs land in the WindowsEvent table instead of the SecurityEvent table.
This means the OOB analytics do not work and ignore these logs.
Describe alternatives you've considered
Modifying the analytics directly in each Sentinel instance is wasted effort, these OOB analytics should already be using ASIM.
Additional context
For example ASimAuthenticationMicrosoftWindowsEvent should be used for the analytic "SecurityEvent - Multiple authentication failures followed by a success"
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
When logs are collected by WEC (i.e. forwarded via a Windows Server) the security logs land in the WindowsEvent table instead of the SecurityEvent table.
This means the OOB analytics do not work and ignore these logs.
Describe the solution you'd like
Update the analytics included with the Windows Security Events solution to use ASIM, as per Microsoft's own recommendations here.
https://techcommunity.microsoft.com/blog/fasttrackforazureblog/windows-events-how-to-collect-them-in-sentinel-and-which-way-is-preferred-to-det/3997342
Describe alternatives you've considered
Modifying the analytics directly in each Sentinel instance is wasted effort, these OOB analytics should already be using ASIM.
Additional context
For example ASimAuthenticationMicrosoftWindowsEvent should be used for the analytic "SecurityEvent - Multiple authentication failures followed by a success"
The text was updated successfully, but these errors were encountered: