Search code examples
azureanalyticsazure-log-analytics

Failed to resolve table or column expression named 'SecurityEvent'

I am trying to find security events from Azure log analytics. But its not taking the SecurityEvent keyword. It give the error "Failed to resolve table or column expression named 'SecurityEvent'".

// Accounts Failed to Logon 
// Counts failed logons by target account. 
SecurityEvent
| where EventID == 4625
| summarize count() by TargetAccount
Error 'where' operator: Failed to resolve table or column expression named 'SecurityEvent' If issue persists, please open a support ticket. enter image description here

Thanks

Solution

  • As Oleh Tarasenko suggested , if you need security events then they need to be enabled from Security Center.

    Kindly note security events are collected from windows machines by Azure Security Center or Azure Sentinel. However, Azure Monitor agent does not support solutions and insights such as VM insights and Azure Security Center as of now. The only scenario currently supported is collecting data using the data collection rules that you configure.

    • You can use AMA to natively collect Security Events, same as other Windows Events. These flow to the 'Event' table in your Log Analytics workspace.

    • If you have Sentinel enabled on the workspace, the Security Events flow via AMA into the 'SecurityEvent' table instead (same as using Log Analytics Agent). This will always require the solution to be enabled first.

    For your reference , availability of solutions for AMA.

    enter image description here

    Set up the Windows Security Events connector in Azure Sentinel

    To collect your Windows security events in Azure Sentinel:

    1. From the Azure Sentinel navigation menu, select Data connectors. From the list of connectors, click on Security Events, and then on the Open connector page button on the lower right. Then follow the on-screen instructions under the Instructions tab, as described through the rest of this section.

    2. Verify that you have the appropriate permissions as described under the Prerequisites section on the connector page.

    3. Download and install the Log Analytics agent (also known as the Microsoft Monitoring Agent or MMA) on the machines for which you want to stream security events into Azure Sentinel.For Azure Virtual Machines:

      1. Click on Install agent on Azure Windows Virtual Machine, and then on the link that appears below.
      2. For each virtual machine that you want to connect, click on its name in the list that appears on the right, and then click Connect.

      For non-Azure Windows machines (physical, virtual on-prem, or virtual in another cloud):

      1. Click on Install agent on non-Azure Windows Machine, and then on the link that appears below.

      2. Click on the appropriate download links that appear on the right, under Windows Computers.

      3. Using the downloaded executable file, install the agent on the Windows systems of your choice, and configure it using the Workspace ID and Keys that appear below the download links mentioned above.

      4. For additional installation options and further details, see the Log Analytics agent documentation.

      5. Select which event set (All, Common, or Minimal) you want to stream.

      6. Click Update.

      7. To use the relevant schema in Log Analytics for Windows security events, type SecurityEvent in the query window.

        Validate Connectivity

        It may take around 20 minutes until your logs start to appear in Log Analytics.

    Full documentation : Connect Windows security event data to Azure Sentinel | Microsoft Docs

    Azure Security Center and Azure Defender are now called Microsoft Defender for Cloud you can refer this documentation to enable security events to azure security center.