Microsoft Sentinel
Cloud and workloadsWindows Security Event Id Reference
In brief
The article now states that Windows Security Events via AMA writes to the `SecurityEvent` table, while Windows Forwarded Events writes to `WindowsEvent`. It also adds guidance for forwarded events that do not trigger built-in rules.
What Defender admins need to know
Use the table distinction when troubleshooting connector data and rule triggering.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
#Customer intent: As a security analyst, I want to select specific sets of Windows security events to ingest into Microsoft Sentinel, so that I can efficiently monitor and detect potential threats while managing data volume.
When ingesting security events from Windows devices using the Windows Security Events data connector (including the legacy version), you can choose which events to collect from among the following sets:
The Windows Security Events via AMA connector writes these events to the SecurityEvent table, which is queried by many built-in Windows security analytics rules. The Windows Forwarded Events connector writes forwarded events to WindowsEvent instead. If forwarded events don't trigger a built-in rule, verify which table the rule queries, and either use the Windows Security Events via AMA connector or adapt the rule for WindowsEvent.
All events - Collects the full, unfiltered set of events from the Windows Security event log and the AppLocker event log channels. The Security log (
Windows Logs > Securityin Event Viewer) records auditing events such as logons, privilege use, and policy changes. The AppLocker logs (Application and Services Logs > Microsoft > Windows > AppLocker) cover application execution and installation policies. This set does not include events from other Windows event logs such as Application, System, or Setup.Common - A standard set of events for auditing purposes. A full user audit trail is included in this set. For example, it contains both user sign-in and user sign-out events (event IDs 4624, 4634). There are also auditing actions such as security group changes, key domain controller Kerberos operations, and other types of events in line with accepted best practices.
@@ -5,7 +5,7 @@ ms.author: guywild author: guywi-ms ms.reviewer: noak ms.topic: reference-ms.date: 03/12/2026+ms.date: 08/07/2026 #Customer intent: As a security analyst, I want to select specific sets of Windows security events to ingest into Microsoft Sentinel, so that I can efficiently monitor and detect potential threats while managing data volume. @@ -15,6 +15,8 @@ ms.date: 03/12/2026 When ingesting security events from Windows devices using the [Windows Security Events data connector](data-connectors-reference.md#windows-security-events-via-ama) (including the legacy version), you can choose which events to collect from among the following sets: +The Windows Security Events via AMA connector writes these events to the `SecurityEvent` table, which is queried by many built-in Windows security analytics rules. The Windows Forwarded Events connector writes forwarded events to `WindowsEvent` instead. If forwarded events don't trigger a built-in rule, verify which table the rule queries, and either use the Windows Security Events via AMA connector or adapt the rule for `WindowsEvent`.+ - **All events** - Collects the full, unfiltered set of events from the Windows Security event log and the AppLocker event log channels. The Security log (`Windows Logs > Security` in Event Viewer) records auditing events such as logons, privilege use, and policy changes. The AppLocker logs (`Application and Services Logs > Microsoft > Windows > AppLocker`) cover application execution and installation policies. This set does *not* include events from other Windows event logs such as Application, System, or Setup. - **Common** - A standard set of events for auditing purposes. A full user audit trail is included in this set. For example, it contains both user sign-in and user sign-out events (event IDs 4624, 4634). There are also auditing actions such as security group changes, key domain controller Kerberos operations, and other types of events in line with accepted best practices.