Azure Monitor Agent Not Reporting Security Events

Question

We are in the process of migrating from the Azure Log Analytics Agent to the Azure Monitor Agent across our servers. The agent appears to be installed correctly, and the Data Collection Rules (DCR) are set up to capture relevant Security Events.

We have verified data ingestion using Microsoft's official query, which shows that the data is being ingested. However, the customer reports that the Azure Monitor Agent is not showing specific Security Events (such as EventID 4672, among others) from the servers where it is deployed.

Steps Taken:

1. Verified the agent installation and confirmed it is up to date.
2. Validated DCR settings.
3. Confirmed, no FW or Network issues.

What should be our next troubleshooting steps?

Thank you in advance.

Answer 1

Hi Fabian,

Welcome to Microsoft Q&A Forum, thank you for posting your query here!

How to configure Security Events collection with Azure Monitor Agent please refer link below which has more information

https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/how-to-configure-security-events-collection-with-azure-monitor-agent/3770719|

If the above link doesn't help you, please try to follow the below steps.

If the Azure Monitor Agent (AMA) isn't capturing specific Security Events like EventID 4672, despite being deployed and configured, this could be due to a few possible issues in the data collection configuration, agent permissions, or limitations with the agent. Here’s a targeted troubleshooting guide:

1. Confirm Event ID Collection in Data Collection Rules (DCR)

Verify Explicit Inclusion of EventID 4672: In your DCR settings, confirm that EventID 4672 (and any other missing Event IDs) are explicitly listed. By default, not all Security Events may be captured, so you must specify each relevant Event ID if you're targeting specific types.

Review DCR Target Scope: Make sure the DCR scope applies to the correct machines or resource group. Double-check if the DCR is indeed linked to the servers in question to ensure proper data flow.

2. Check Permissions for Accessing Security Logs

• Security Log Read Permissions: The AMA must have adequate permissions to access the Security event logs. If permissions are restricted, AMA may miss certain events. Verify that the assigned permissions for AMA include read access to the Security logs, which can be set up in the following way:
  • Assign the Log Analytics Contributor role or ensure equivalent permissions.
    • If needed, configure an additional Log Analytics Reader or a custom role if only specific permissions are desired.

3. Validate Event Generation on the Server

Test Event Generation for EventID 4672: Manually create a Security Event with EventID 4672 on one of the target servers to ensure the event is logged locally. This can be done using PowerShell or through actions that typically trigger EventID 4672 (privileged logon events).

Confirm Local Event Logs: After triggering, check that EventID 4672 appears in the server’s local Event Viewer under Security logs. If the event doesn’t appear, it could indicate an issue with the event source rather than the agent.

1. Run Targeted Queries in Log Analytics Workspace
   Query for Security Events: In your Log Analytics Workspace, run a direct query to look for the specific EventID:
   SecurityEvent
   | where EventID == "4672"
   | take 10
   Please let us know if you have any further queries. I’m happy to assist you further.    

---

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.