You need to onboard security logs into Microsoft Sentinel from 12 on-premises Windows Server domain controllers and several Linux firewalls. All servers are Azure Arc–enabled, and you must avoid the legacy Log Analytics agent. You must collect Windows Security Events (including 4688) from the domain controllers and CEF-formatted events from the firewalls. What two actions should you take?

The first correct action is to enable the Windows Security Events via AMA data connector in Microsoft Sentinel and assign its data collection rule to the Arc-enabled domain controllers. This directly addresses the requirement to collect Windows Security Events, including event ID 4688, from the domain controllers using the Azure Monitor Agent (AMA), which is the preferred agent and avoids the legacy Log Analytics agent. The second correct action is to deploy the Azure Monitor Agent on an Arc-enabled Linux log forwarder and enable the Common Event Format (CEF) via AMA connector, then configure the firewalls to send CEF over Syslog to that forwarder. This allows for the collection of CEF-formatted events from the Linux firewalls using AMA, as required. The incorrect options involve using the legacy Log Analytics agent (MMA/OMS) or Windows Event Forwarding with MMA, which are explicitly to be avoided. Streaming to Azure Event Hubs is an alternative, but not the direct and most efficient method for CEF collection via AMA.