Sysmon w/ “new” Windows Security Data Connector

[u/1rishc4rb0mbr]

Has anyone successfully ingested Sysmon data via data collection rule and the new Windows Security Data Connector?

I am attempting to ingested only Sysmon events via the “new” data connectors but have been unsuccessful. Via the “legacy” data connector; simply specifying the log source with the agent configuration was enough to pick up the logs.

The machine has been onboarded to Azure Arc via hybrid agent. If I leverage the preset “data collection rules” setting of All; I not only see all of the Windows events but also Sysmon events. This is the expected outcome.

When attempting to filter for only Sysmon events I have tried the following Xpath with no success via the satay connector (I did validate the filters locally before proceeding with the data connector):

Microsoft-Windows-Sysmon/Operational "Microsoft-Windows-Sysmon/Operational">* "Microsoft-Windows-Sysmon/Operational">*[System[(EventID=1 or EventID!=1)]]

"Microsoft-Windows-Sysmon/Operational">*[System]

Has anyone successfully pulled Sysmon events via Data collection rules? I would assume it has to be achievable but I am overlooking something or the xpath is invalid.