MS Defender in Log Analytics through Azure Monitoring Agent

Question

Hello, Does anyone know if it is possible to collect MS Defender logs (AV only, not ATP) through Azure Monitoring Agent on Windows 10 systems (not Azure) and then centralise them in Log Analytics or Event Hub and send them to a third party SIEM? You may have asked some nonsense, I'm a bit lost on this subject. Thank you very much in advance and best regards,

Answer 1

@angelsm84 Kindly note Microsoft Monitoring Agent can be installed on non-Azure services to collect logs. As MS Defender logs can be sent to Log Analytics workspace as the log events are stored in Event viewer. To enable the event viewer logs to be stored in Log Analytics workspace. Go to Log Analytics workspace -> Advanced Settings -> Data -> Windows Event Logs -> Add the Log name in the highlighted section as shown in image and the click + ( You can get it from event viewer by clicking on Properties of the Log). For more information, refer this article.

To send Log Analytics data to third party tools , you can refer this article which provides detail steps and also the list of third part tools that are supported.

Answer 2

Hi,
You could refer to the following link:
https://learn.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows#install-agent-using-dsc-in-azure-automation
Hope above information can help you.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

The questions are:

Is the installation of Azure Monitoring Agent supported on non-VDI Windows 10 systems?

According to the requirements I see no problem:
https://learn.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview#supported-operating-systems

Afterwards, can antivirus events also be sent to Log Analytics with this agent?

And finally, how can I send Log Analytics events to a third party SIEM?

As you can see, there are many questions. I can't find an answer anywhere.

Thanks in advance.