Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,065 questions
Incorrect OS identified by Azure Monitoring Agent in Sentinel
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 12%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
Rob Milman
1
Reputation point
I just noticed that there is incorrect OS tagging happening in Sentinel. Looking at a domain controller running Windows Server 2016 show up as;
{count} votes
-
JamesTran-MSFT 36,541 Reputation points Microsoft Employee2021-02-04T22:30:42.27+00:00 @Rob Milman
Thank you for your post!- Are you able to share any documentation you followed to set up the Azure Monitoring Agent in Sentinel? This way I can gain a better understanding of your issue.
- Were there any changes that could've caused the OS version to not show correctly? i.e. OS upgraded, etc.
- Have you tried to troubleshoot this issue? Or restarting the domain controller?
Any additional information or screenshots would be greatly appreciated.
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue. -
Rob Milman 1 Reputation point
2021-02-04T22:46:18.01+00:00 Thanks for the quick response. We simply followed the instructions in Sentinel for adding an agent. See the attached screenshot from Sentinel.
There have been no changes, this was always a domain controller and has been for many years, we have dozens of domain controllers being a large post-secondary institution. Most definitely can't reboot a domain controller, that's a critical server, which is why we are monitoring it. I haven't done any troubleshooting other than searching Google to see if anyone has had the same problem.
-
JamesTran-MSFT 36,541 Reputation points Microsoft Employee
2021-02-05T18:39:44.08+00:00 @Rob Milman
Thank you for the quick response and screenshot! I've reached out to our support engineering team regarding this and will update as soon as possible.If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Sign in to comment