Microsoft Sentinel
Cloud and workloadsConnect Services Windows Based
In brief
The documentation now states that Windows Event Forwarding events are written to the `WindowsEvent` table, not `SecurityEvent`. It also notes that built-in rules querying `SecurityEvent` won't match data stored only in `WindowsEvent`.
What Defender admins need to know
Administrators should verify that their analytics rules target the table receiving their forwarded events to avoid gaps in detection coverage.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
#Customer intent: As a security engineer, I want to connect Microsoft Sentinel to various data sources using Windows agent-based connectors so that I can efficiently ingest and manage security event data for comprehensive threat detection and response.
- You must have Windows Event Collection (WEC) enabled and running, with the Azure Monitor Agent installed on the WEC machine.
- We recommend installing the [Advanced Security Information Model (ASIM)](normalization.md) parsers to ensure full support for data normalization. You can deploy these parsers from the [`Azure-Sentinel` GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/Parsers/ASim%20WindowsEvent) using the **Deploy to Azure** button there.
Install- Events collected through Windows Event Forwarding are written to therelated Microsoft Sentinel solution`WindowsEvent` table, including events forwarded from theContent Hub in Microsoft Sentinel. For more information, see Discover and manage Microsoft Sentinel out-of-the-box contentWindows Security log. They aren't written to the `SecurityEvent` table.- Install the related Microsoft Sentinel solution from the Content Hub in Microsoft Sentinel. For more information, see Discover and manage Microsoft Sentinel out-of-the-box content
Perform the following steps to create a data collection rule in the Microsoft Sentinel portal.
From Microsoft Sentinel, select Configuration> Data connectors. Select your connector from the list, and then select Open connector page on the details pane. Then follow the on-screen instructions under the Instructions
tab, as describedtab and complete the remaining steps inthe steps that follow.this procedure.Verify that you have the appropriate permissions as described under the Prerequisites section on the connector page. At minimum, you need read and write permissions on the Microsoft Sentinel workspace.
Create data collection rules using the API
You can also create data collection rules using the API, which can make life easier if you're creating many rules, such as if you're an MSSP.a managed security service provider (MSSP). Here's an example (for the Windows Security Events via AMA connector) that you can use as a template for creating a rule:
Send the following PUT request to create or update a data collection rule that defines the event sources, the destination Log Analytics workspace, and the data flow between them.
@@ -5,9 +5,9 @@ ms.author: guywild author: guywi-ms ms.reviewer: ofshezaf ms.topic: how-to-ms.date: 06/15/2026+ms.date: 08/07/2026 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a security engineer, I want to connect Microsoft Sentinel to various data sources using Windows agent-based connectors so that I can efficiently ingest and manage security event data for comprehensive threat detection and response. @@ -44,6 +44,10 @@ The [Azure Monitor Agent](/azure/azure-monitor/agents/azure-monitor-agent-overvi - You must have Windows Event Collection (WEC) enabled and running, with the Azure Monitor Agent installed on the WEC machine. - We recommend installing the [Advanced Security Information Model (ASIM)](normalization.md) parsers to ensure full support for data normalization. You can deploy these parsers from the [`Azure-Sentinel` GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/Parsers/ASim%20WindowsEvent) using the **Deploy to Azure** button there.+ - Events collected through Windows Event Forwarding are written to the `WindowsEvent` table, including events forwarded from the Windows Security log. They aren't written to the `SecurityEvent` table.++> [!IMPORTANT]+> Microsoft Sentinel analytics rules and solution content can be table-specific. Many built-in Windows Security Events rules, including some near-real-time rules, query `SecurityEvent` and don't match data stored only in `WindowsEvent`. If you need those rules without modification, use the Windows Security Events via AMA connector. Otherwise, adapt the rule queries to use `WindowsEvent` or supported ASIM parsers. - Install the related Microsoft Sentinel solution from the Content Hub in Microsoft Sentinel. For more information, see [Discover and manage Microsoft Sentinel out-of-the-box content](sentinel-solutions-deploy.md). @@ -51,7 +55,7 @@ The [Azure Monitor Agent](/azure/azure-monitor/agents/azure-monitor-agent-overvi Perform the following steps to create a data collection rule in the Microsoft Sentinel portal. -1. From Microsoft Sentinel, select **Configuration**> **Data connectors**. Select your connector from the list, and then select **Open connector page** on the details pane. Then follow the on-screen instructions under the **Instructions** tab, as described in the steps that follow.+1. From Microsoft Sentinel, select **Configuration**> **Data connectors**. Select your connector from the list, and then select **Open connector page** on the details pane. Then follow the on-screen instructions under the **Instructions** tab and complete the remaining steps in this procedure. 1. Verify that you have the appropriate permissions as described under the **Prerequisites** section on the connector page. At minimum, you need read and write permissions on the Microsoft Sentinel workspace. @@ -90,7 +94,7 @@ You'll see all your data collection rules, including those you [create using the ## Create data collection rules using the API -You can also create data collection rules using the API, which can make life easier if you're creating many rules, such as if you're an MSSP. Here's an example (for the [Windows Security Events via AMA](./data-connectors-reference.md#windows-security-events-via-ama) connector) that you can use as a template for creating a rule:+You can also create data collection rules using the API, which can make life easier if you're creating many rules, such as if you're a managed security service provider (MSSP). Here's an example (for the [Windows Security Events via AMA](./data-connectors-reference.md#windows-security-events-via-ama) connector) that you can use as a template for creating a rule: Send the following PUT request to create or update a data collection rule that defines the event sources, the destination Log Analytics workspace, and the data flow between them.