You have 20 on-premises Windows Server virtual machines and an Azure subscription with a Microsoft Sentinel workspace (Workspace1). You need to collect and forward events from the on-prem VMs to Workspace1 and be able to apply filters to reduce collected event volume. Which two components should you install on each VM?

The Azure Connected Machine agent (part of Azure Arc) is necessary to onboard the on-premises Windows Server virtual machines to Azure, allowing them to be managed as Azure resources. This is a prerequisite for installing Azure extensions. The Azure Monitor agent (AMA) is the modern agent for collecting log and performance data from Azure VMs and Azure Arc-enabled servers, and it supports data collection rules (DCRs) which allow for filtering events at the source, reducing the volume of data sent to Log Analytics. The Azure VM Dependency agent extension for Windows and the Dependency agent are used by Azure Monitor for collecting process and dependency data for features like Service Map, not for general event collection. The Log Analytics VM extension for Windows is the legacy agent for data collection and does not offer the same granular filtering capabilities as the Azure Monitor agent with DCRs.