You have three Azure subscriptions. Each subscription contains multiple virtual machines that run Windows Server. You have a Microsoft Sentinel workspace. You need to ensure that failed sign-in…

Question

Options

• AFrom the Microsoft Defender portal, install the Windows Security Events solution.
• BOn each virtual machine, create an event subscription.
• COn each virtual machine, install the Azure Connected Machine agent.
• DFrom the Microsoft Defender portal, install the Syslog solution.

• A
  4% (1)
• B
  12% (3)
• C
  69% (18)
• D
  15% (4)

Explanation

The Azure Connected Machine Agent (Arc Agent) works with the Azure Monitor Agent (AMA) to get data into Microsoft Sentinel, but the AMA is the primary agent for log collection, using the Arc Agent to extend Azure management to hybrid machines; they aren't the same, but complementary. The Arc Agent connects servers (on-prem, other clouds) to Azure as if they were Azure VMs, then the AMA (installed as an extension) collects security logs (like Syslog/Windows Events) from these Arc-enabled machines and sends them to Sentinel. How They Work Together for Sentinel: Azure Connected Machine Agent (Arc Agent): Installs on non-Azure servers (Windows/Linux) to bring them under Azure management (Azure Arc). Azure Monitor Agent (AMA): Installed as an extension on these Arc-enabled servers (or Azure Data Collection Rules (DCRs): You define DCRs to tell the AMA what logs (e.g., Syslog, Windows Security Events) to collect from the servers. Microsoft Sentinel: The collected logs are sent to Azure Monitor and then to your Sentinel workspace for threat detection and analysis. So, the Arc Agent makes your server "Azure-ready," and the AMA collects the security data from that server for Sentinel. https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview

No community discussion yet for this question.