You have an on-premises virtual machine named VM1 that runs Windows Server. You have a Microsoft Sentinel workspace named Workspace1. You install the Azure Connected Machine agent on VM1. You need…

Question

Options

• AOnVM1, install the Microsoft Monitoring Agent.
• BOn VM1, install the Log Analytics agent.
• CFrom the Microsoft Defender portal, add the Windows Security Events via AMA data connector.
• DFrom the Microsoft Defender portal, add the Syslog via AMA data connector.
• EOn VM1, enable the Azure Monitor Agent extensions.
• FFrom the Microsoft Defender portal, create a data collection rule (DCR) that targets VM1.

• A
  8% (2)
• B
  15% (4)
• D
  4% (1)
• E
  73% (19)

Explanation

The Azure Connected Machine Agent (Arc Agent) works with the Azure Monitor Agent (AMA) to get data into Microsoft Sentinel, but the AMA is the primary agent for log collection, using the Arc Agent to extend Azure management to hybrid machines; they aren't the same, but complementary. The Arc Agent connects servers (on-prem, other clouds) to Azure as if they were Azure VMs, then the AMA (installed as an extension) collects security logs (like Syslog/Windows Events) from these Arc-enabled machines and sends them to Sentinel. Collect Windows events from virtual machine with Azure Monitor Windows event logs are some of the most common sources for health of the client operating system and workloads of Windows machines. You can collect events from standard logs, such as System and Application, and any custom logs created by applications you need to monitor. Collect Windows event logs from virtual machines using a data collection rule (DCR) with a Windows events data source. https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events

No community discussion yet for this question.