Does Microsoft support WEC,WEF send logs over http for NON domain machines?

Hello Sukhwant Singh Chauhan,

Windows Event Forwarding (WEF) is primarily designed for domain-joined environments. However, it is technically possible to configure WEF for non-domain machines, though it requires additional setup and infrastructure.

To enable this in a non-domain scenario, you’ll need to leverage Azure Arc. because sentinel can't pull the logs directly without this setup. 

Once the Windows Event Collector (WEC) servers are deployed, you must connect them to Azure using Azure Arc. This connection allows Microsoft Sentinel to integrate with the WEC server.

Please note:

• The Microsoft Sentinel connector for Windows Forwarded Events (Preview) requires the Azure Monitor Agent (AMA).
• AMA is not supported on the legacy MMA agent, and its deployment requires Azure Arc for non-Azure machines.
• Once configured, the WEC server will forward events to a Log Analytics Workspace (LAW) monitored by Microsoft Sentinel, enabling full visibility into logs from machines outside of Azure.

Important: Microsoft Sentinel must be deployed and enabled before installing the AMA agent.

Below is the overview to achieve the goal: Additionally, for a complete walkthrough, please refer to the following Microsoft Tech Community article, which outlines the entire process step-by-step:

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/forward-on-premises-windows-security-event-logs-to-microsoft-sentinel/3040784

Please let me know if you need any further assistance required.

If the comment helpful, please click upvote it.

Thanks

Hello Sukhwant Singh Chauhan,

Just want to check if the above comment provided by @vinod pittala worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment is helpful, please click "Upvote it"

Thankyou

Please clarify

1. Would it be possible by using WEC, WEF to sendover http? Note Windows Machine is not domain join and it workgroup machines
2. If we have use https or certificate is there a workaround that there should be no need to reboot endpoint which is sending logs?
3. Once the Windows logs are received by Microsoft sentinel would it be written in Security event table directly?
4. Is there a possibility that syslog logs received by AMA can written directly to Security event table directly in Microsoft sentinel?
5. Most important does Microsoft support editing or mapping of Security event table in Microsoft sentinel?

Hello Sukhwant Singh Chauhan,

Below is the clarification for your queries.

1. Yes, WEF supports both HTTP and HTTPS protocols for log forwarding. However:
   • HTTP can be used, but it's not secure and is not recommended for production, especially when forwarding sensitive logs.
   • For non-domain joined (workgroup) machines, configuring WEF over HTTP is technically possible, but requires manual configuration of certificates and WinRM settings, and might pose security risks.
   Key point: It works, but not secure or recommended for workgroup environments unless you implement strong firewall rules and network isolation.
2. There is no official Microsoft documentation that guarantees a reboot-free setup when configuring HTTPS and certificates for WEF on non-domain machines. However, some community responses suggest that if WinRM and certificates are pre-configured correctly, a reboot might not be necessary. This is not guaranteed and may depend on the OS version and certificate store behavior.
3. No, not directly. Logs forwarded via WEC/WEF and ingested through AMA typically land in the WindowsEvent table, not the SecurityEvent table. You can filter and route specific event IDs using XPath queries in the Data Collection Rule (DCR) to control what gets ingested.
4. No. Syslog logs collected via AMA are written to the Syslog or CommonSecurityLog tables, depending on the format (e.g., CEF). These logs do not go into the SecurityEvent table, which is reserved for Windows Security logs. There is no supported way to write syslog data directly into SecurityEvent
5. No, Microsoft does not support editing or remapping the SecurityEvent table. It is a system table managed by Microsoft Sentinel and Azure Monitor. However, you can:
   • Use Kusto queries to transform and visualize data.
   • Create custom tables and use Logic Apps or Data Collection Rules to route and enrich data before ingestion.

If the comment helpful, please click Upvote it.

Thanks

1. For non-domain joined (workgroup) machines, configuring WEF over HTTP is technically possible, but requires manual configuration of certificates and WinRM settings, and might pose security risks.

Referring to point number 1, above : -

a) Technically how configure WEC, WEF with http. Please share some reference document.

b) When you say it require certificate it means it will HTTPs, secure?

2. Endpoint which will send events over WEC, WEF those events would be written directly to security event table?

3)No, Microsoft does not support editing or remapping the SecurityEvent table. It is a system table managed by Microsoft Sentinel and Azure Monitor. However, you can:

a) can logs received in syslog or CommonSecurityLog table be mapped to security event table with DCR? or Logic Apps is must?