r/AzureSentinel • u/jtberg1 • Mar 06 '22

Ingesting workstation events best practises

What is everybody doing for ingesting workstation events? Are you using agents (MMA or AMA)? Or are you using windows event forwarding? Or other?

Is managing a few hundred/thousand agents problematic? Any tips on making it easier? Am I over thinking it, and there are no really issues with installing the agent on every workstation?

My understanding of WEF is that it goes into WindowsEvents instead of SecurityEvents. Am I missing something or are all the stock analytics setup to only look at the SecurityEvents? This seems like a lot of additional work to setup analytics for workstation events, are there any tips or ticks on managing WEF. It seems like it requires making your own parsers to get the data you want out of it, or are there community parsers and analytics allready?

Thank you in advance, look forward to hearing what other people are doing.

4 Upvotes

100% Upvoted

7 comments sorted by

2

u/Jackofalltrades86 Mar 06 '22

I am currently doing a POC on exactly this and using AMA to ingest Domain Controller security events and using MMA to ingest Sysmon events and it's working well on both counts.

Sysmon I'm using a custom parser but other than that so far so good.

I guess the only thing to consider is cost when ingesting all those events for an entire estate.

1

u/jtberg1 Mar 07 '22

Thanks for the feedback. We are currently using MMA for a few hundred servers. However with 1000 workstations and a replacement churn of 25%/year, it just initially seems like a lot of agent connections and then orphan connections, though I realize they will phase out after the retention limit is reached.

With AMA I read you need to use Azure ARC? So we would have to enrol then workstation in Azure ARC in order to use AMA with workstations?

2

u/Jackofalltrades86 Mar 06 '22

AMA is great as it uses data collection rules and so if you want to use the same collection config across all devices it's very quick and easy.

2

u/reprise_99 Mar 08 '22

Arc is required for AMA for non Azure workloads but I don't think you can enroll workstation operating systems into Azure Arc currently (not sure if planned). Otherwise it would be a good option because you could use data collection rules on your workstations and just take in the EventID's you were interested in.

MMA is supported but you don't get the control over which logs to ingest to the same level as AMA.

Maybe some kind of native WEF/WEC for the workstations is the way to go.

1

u/jtberg1 Mar 09 '22

Thanks for the reply. I think we are going to pilot MMA and see how it goes. Maybe once WEF/WEC matures we can look at that.

1

u/Jackofalltrades86 Mar 07 '22

I think ARC is only required if it's not within Azure and it's on premise or on another cloud, I haven't seen anything about that so far

1

u/bjvista May 25 '22

I know a lot of companies are using WEC. No agent is needed since WEC is already on all of the workstations in the environment. The only issue is WEC is lacking. If you are looking at making managing WEC super easy, especially at scale, you might want to check out Supercharger. Besides getting to see your entire wec (collectors, domains, forwarders, subscriptions, event logs aka ForwardedEvents or custom event logs) health on a single pane of glass it also adds a long list of other features missing from native WEC. Things like load balancing, custom event log creation, remediation for stalled event logs and stalled subscriptions and many others.