question

AlexisSalazarNez-8354 avatar image
0 Votes"
AlexisSalazarNez-8354 asked AlexisSalazarNez-8354 commented

Log Analytics Workspace - event4625

Buenas,

Espero que se encuentren bien.

Me gustaría escalar esta pregunta, tengo un LAW para su respectiva ingesta de logs, pero no logro realizar la ingesta de fallos de inicio de sesión a través del evento 4625 y generar una alerta.

Estoy ejecutando la siguiente consulta:

SecurityEvent
| where EventID == 4625
| summarize FailedLogins = count() by Account,Computer, IpAddress
| sort by FailedLogins desc

Me gustaría saber si estoy omitiendo alguna configuración, ya que me indica que no tiene data.


No results found from the last 24 hours. (Se intenta con diferente rango)

Saludos.

azure-monitor
· 1
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

tbgangav-MSFT avatar image tbgangav-MSFT ·

Hi @AlexisSalazarNez-8354,

Did you get chance to check my earlier response? Let me know if have any further queries with regards to it.

0 Votes 0 ·

1 Answer

tbgangav-MSFT avatar image
0 Votes"
tbgangav-MSFT answered AlexisSalazarNez-8354 commented

Hi @AlexisSalazarNez-8354,

As mentioned in this official Azure document, we can't configure collection of security events from the workspace using Log Analytics agent. We must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. Azure Monitor agent can also be used to collect security events.

Few other related resources:
https://docs.microsoft.com/en-us/azure/architecture/framework/security/monitor-logs-alerts
https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent
https://docs.microsoft.com/en-us/answers/questions/235333/index.html
https://docs.microsoft.com/en-us/answers/questions/787544/index.html

· 2
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AlexisSalazarNez-8354 avatar image AlexisSalazarNez-8354 ·

Solved!

Thank you for your help.

1 Vote 1 ·
tbgangav-MSFT avatar image tbgangav-MSFT AlexisSalazarNez-8354 ·

Hi @AlexisSalazarNez-8354,

Thanks for letting me know that the issue is solved. Can you share how you have solved the issue so it might help other community members who might be looking for answer to similar question?

0 Votes 0 ·