Events for Servers

RT-7199 511

I can see logs under Advanced Hunting in the below portal for workstations. How can I see same data on-prem servers that have been onboarded and connect to LAW(Log analytics Workspace). I want IdentityLogonEvents and DeviceNetworkEvents

Microsoft 365 Security
https://security.microsoft.com

Also is there a a way to export logs to LAW, We don't Sentinel?

Marilee Turscak-MSFT 36,141 Reputation points Microsoft Employee

2021-01-27T23:14:23.537+00:00

Are you looking for sign-in events specifically? It looks like you can get the IdentityLogonEvents data through the AADSignInEventsBeta and query it through the sign-in activity reports.

"The AADSignInEventsBeta table is currently in beta and is being offered on a short-term basis to allow you to hunt through Azure Active Directory (AAD) sign-in events. We will eventually move all sign-in schema information to the IdentityLogonEvents table."

https://video2.skills-academy.com/en-us/microsoft-365/security/mtp/advanced-hunting-aadsignineventsbeta-table?view=o365-worldwide
Marilee Turscak-MSFT 36,141 Reputation points Microsoft Employee

2021-01-27T23:14:41.283+00:00
To stream sign-in logs to a Log Analytics Workspace,

Sign in to the Azure portal.

Select Azure Active Directory > Diagnostic settings > Add diagnostic setting. You can also select Export Settings from the Audit Logs or Sign-ins page.

In the Diagnostic settings menu, select the Send to Log Analytics workspace check box, and then select Configure.

Select the Log Analytics workspace you want to send the logs to, or create a new workspace in the provided dialog box.

Do either or both of the following:

To send audit logs to the Log Analytics workspace, select the AuditLogs check box.
To send sign-in logs to the Log Analytics workspace, select the SignInLogs check box.

Select Save to save the setting.

After about 15 minutes, verify that events are streamed to your Log Analytics workspace.

1 answer

RT-7199 511 Reputation points

2021-01-29T06:57:16.923+00:00

@MarileeTurscak This is a hybrid network and the logs I want are for on-prem servers. Azure AD has diagnostic logs enabled already.
What I have figured it out is that i might need MAM sensor for the logs I Want.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Share via

Events for Servers

1 answer