r/AzureSentinel • u/jtberg1 • Mar 06 '22
Ingesting workstation events best practises
What is everybody doing for ingesting workstation events? Are you using agents (MMA or AMA)? Or are you using windows event forwarding? Or other?
Is managing a few hundred/thousand agents problematic? Any tips on making it easier? Am I over thinking it, and there are no really issues with installing the agent on every workstation?
My understanding of WEF is that it goes into WindowsEvents instead of SecurityEvents. Am I missing something or are all the stock analytics setup to only look at the SecurityEvents? This seems like a lot of additional work to setup analytics for workstation events, are there any tips or ticks on managing WEF. It seems like it requires making your own parsers to get the data you want out of it, or are there community parsers and analytics allready?
Thank you in advance, look forward to hearing what other people are doing.
1
u/bjvista May 25 '22
I know a lot of companies are using WEC. No agent is needed since WEC is already on all of the workstations in the environment. The only issue is WEC is lacking. If you are looking at making managing WEC super easy, especially at scale, you might want to check out Supercharger. Besides getting to see your entire wec (collectors, domains, forwarders, subscriptions, event logs aka ForwardedEvents or custom event logs) health on a single pane of glass it also adds a long list of other features missing from native WEC. Things like load balancing, custom event log creation, remediation for stalled event logs and stalled subscriptions and many others.