Share via

What's the best way to get on-premise Domain Controller Logs into Sentinel?

Sam C 46 Reputation points
2020-07-23T15:17:53.777+00:00

I'm working to get logs from an on-prem server into Sentinel. Really all I need is visibility into what's going on, and some route to respond to threats so it doesn't necessarily have to be Sentinel but that's what I've been using so far to monitor Azure Active Directory. The DC server has the MMA agent installed, but I think I'm only able to see the 'Heartbeat' (the server itself checking in with the network to verify it's working). How do I get the logs of what that DC is seeing itself into Sentinel (or Azure)?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,158 questions
0 comments
Accepted answer
  1. Gonzalo DAngelo 81 Reputation points
    2020-07-23T16:18:56.567+00:00
    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.