Unable to get Security Event in log analytics from data collection rule in Azure Monitor

Question

Unable to get Security Event in log analytics from data collection rule in Azure Monitor. I want to capture security events like 4624 for particular VMs. I created data collection rule in azure monitor and Added the VM in the resource and added windows event logs in source(Selected All checkboxes).
In destination I have given log analytics workspace but unable to get SecurityEvent table itself.

Answer 1

@Praveen Mittapalli Apologies for late response. Kindly note security events are collected from windows machines by Azure Security Center or Azure Sentinel. However, Azure Monitor agent does not support solutions and insights such as VM insights and Azure Security Center as of now. The only scenario currently supported is collecting data using the data collection rules that you configure.

• You can use AMA to natively collect Security Events, same as other Windows Events. These flow to the 'Event' table in your Log Analytics workspace.
• If you have Sentinel enabled on the workspace, the Security Events flow via AMA into the 'SecurityEvent' table instead (same as using Log Analytics Agent). This will always require the solution to be enabled first.

For your reference , availability of solutions for AMA.

In your case, for security events , I would suggest you to query Event table of log analytics workspace.