This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 99%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECL%3C/text%3E%3C/svg%3E)
I have a centralised Log Analyst Workspace created under a subscription and have it connected to other subscriptions for events/logs collection.
Would appreciate some expertise insights if and how the centralised workspace can be integrated into Azure Security Center (ASC).
Some additional background of my current environment:
We are at the beginning deployment state. The tenants/resources are still in AAD free version. They will be upgraded to Premium P2 in a month or 2.
Currently, when monitoring the logs of the centralised workspace, only the following Log Management data are available:
The data not yet captured include the following:
Would also appreciate comments if those current unavailable data will be captured once the tenants have been upgraded to P2.
Thank you.
@Christopher Lee - Server Admin
Thank you for your post! Are you able to provide and documentation that you followed or are referencing so I can gain a better understanding of your issue?
Any additional information or screenshots would be greatly appreciated!
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 38%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECL%3C/text%3E%3C/svg%3E)
I was referencing many Azure-related Microsoft documents but had difficulty in forming a full picture on (what) the events from the resources (like VMs) get into Security Center for monitoring.
Please let me know if this screenshot helps in your understanding of my question.
For Azure VMs, VMSS, IaaS containers, and non-Azure (including on-premises) machines, the Log Analytics agent, reads various security-related configurations and event logs from the machine and copies the data to your workspace for analysis. You can enable automatic provisioning of the Log Analytics agent, which deploys the agent on all supported Azure VMs and any new ones created. You can also leverage Continuous export for ASC, which lets you fully customize what will be exported, and where it will go.
I've added the azure-monitor tag to this thread so our log analytics team can provide their insights on this as well.
Thank you for your time and patience throughout this issue.
@Christopher Lee Thanks a lot for reaching out to us.
To add to what @JamesTran-MSFT has already shared, please review Windows security event options for the Log Analytics agent and see if the data collection for security logs is enabled or not
Would also request you to review the Azure Sentinel integration for Log Analytics if that would cater your needs.
Please review the information and circle back for any additional queries. Thank you
Thank you for the response and advice given, James & Bharathn. Looking at our setting, the auto-provisioning of Log Analytics agent has been turned on but currently, the centralised workspace is not specified, and types of raw data of the Windows security events has not been selected.
However, we do have a centralised Log Analytics workspace created, mentioned earlier, and connected to all subscriptions, as shown below. What is the difference of the workspace connection between these 2 setups?
Do I still need to specify the connection to the centralised workspace by individual subscription in the setting shown on the first screenshot?
Without selecting the type of raw data to store, is "None" the default? Please advise if selecting the raw data storage option is essential as our Security Center currently has been providing recommendations on some controls, as shown in the screenshot below. Just wonder what other security events are missing or unavailable at this juncture. Your additional input will be very much appreciated.
