Sentinel Reconfiguration Testing

Question

Sentinel Reconfiguration Testing

Onyx36 0

Need the below tested with results:

On machines installed with both legacy and new agents - remove the legacy agent (breaking Sentinel connection)

Reconfigure Sentinel to see if Data Collection Rules are automatically recreated.

Need assistance with this as I am not versed in Sentinel.

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-11-10T20:21:46.9066667+00:00

@Onyx36

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

1 answer

Your answer

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-11-10T20:21:46.9066667+00:00

@Onyx36

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

Andrew Blumhardt 10,051 Microsoft Employee

For Windows Security Events you will use the "Windows Security Events via AMA" connector page. From there you can create Windows Security Event DCR rules (it will not be created automatically). Though, any VMs or Arc systems in scope for the DCR rule will get the AMA extension deployed (if not already applied by policy).

These rules created from the connector page may appear to be blank or empty when viewing from the DRC page. That is due to the template not matching the UI criteria. You can verify event collection in the SecurityEvents table. Additional DCR instructions provided below.

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal

Onyx36 0 Reputation points

2023-11-06T18:44:09.3733333+00:00

So basically, they will not be re-created automatically after reconfiguring Sentinel after that connection break?

Share via

Sentinel Reconfiguration Testing

1 answer

Your answer