Windows Event Forwarding subscriptions push events to this server's ForwardedEvents log, and from there AMA, through the Windows Forwarded Events connector, picks them up.
Also called Windows Event Collector.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains WEC in context, with comparison tables and the common traps.
Terms in this definition
- Event subscription
Defines which events a Windows Event Collector gathers and from which source machines; they land in Forwarded Events on the collector.
- Real-time streaming semantic model
Covers live-fed push, streaming and PubNub models, plus streaming dashboard tiles. Microsoft now steers people towards Real-Time Intelligence in Fabric, as these are being retired and new ones can only be made until 31 October 2027.
- Azure Monitor agent
Agent now used to collect logs from a machine's guest OS, driven by data collection rules; it took over from the Log Analytics agent (MMA).
- Windows Forwarded Events
Brings events into the WindowsEvent table of Microsoft Sentinel from a Windows Event Collector running AMA, rather than from every VM individually or into SecurityEvent.