Exercise 03: Validate the Sentinel Deployment

Question

When attempting to work on LAB-03 - Windows Security Events using AMA >> Create Data collection >> Resources >>, there is no list of machines to select from. Take a look at the attached images.

Answer 1

Hi @Sara Adeniyi ,

Welcome to Microsoft Q&A Forum, thank you for posting your query here!

In the view of DCR creation firstly we need the following permissions.

Please refer to the below doc.
Create data collection rules (DCRs) in Azure Monitor - Azure Monitor | Microsoft Learn

And make sure the VM’s are created and chosen from the same RG which has selected while creating the DCR.

The reason for not showing the VM’s in the resources is because of different reasons, anyways it seems that the Azure virtual machine (VM) might not have the required diagnostic settings enabled. To add an Azure virtual machine (VM) to a Data Collection Rule (DCR), the VM must have the required diagnostic settings enabled.

You can follow the below steps to enable diagnostic settings for the Azure virtual machine (VM):

1.Go to the Azure portal and navigate to the virtual machine (VM) that you want to add to the DCR.

2.Click on "Diagnostic settings" under the Monitoring section.

3.Click on "Add diagnostic setting" and provide a name for the diagnostic setting.

4.Select the required diagnostic logs and metrics that you want to collect.

5.Select the destination as "Log Analytics workspace" and choose the workspace that you have configured in the DCR.

6.Click on "Save" to save the diagnostic settings.

Once the diagnostic settings are enabled for the Azure virtual machine (VM), you can try adding it to the DCR again.

let us know if you have any further queries. I’m happy to assist you further.  

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.