I am working in a landscape where several old systems are active. Yes, it's a concern that receives attention and is being addressed, but it's separate from this question.
For the SOC we need Event logging in SIEM, and thus Sentinel. We only need logging from a few servers, according to our MSSP, as the other logging is already collected by MDE & MDI agents or other log-collection methods. So the setup of the additional logging has the focus on a small amount of systems (max 10).
Note, that these systems are OnPrem in our data center.
Azure ARC with AMA is the option we want to go for in the end, but we do not want to introduce such new technology (as ARC in general, is not in use in the environment) overnight. But logging needs to be collected before the end of this month due to compliance requirements.
So, we have two other options: using the MMA agent, which we know will be EoS August this year, but is an agent that some admins have experience with within the test/dev environment. No MMA is enabled in production. It will introduce some risks as we must install an agent on old unstable systems. But it is an option.
Another method could be using a WEC (windows event collector), which will collect/receive the logging from the system in scope (again, this is a small set of systems). This WEC will be enabled on an Azure Windows server, which allows us to enable AMA on it. The advantage of it, is that we do not need to install software on the old systems. Of course, we need a configuration adjustment to get the logging from these systems. Assuming WEF (windows event forwarder) has less impact than, eg. installing MMA.
Main question: will I face compatibility issues if I collect the data via WEC and ingest it into Sentinel via the AMA agent installed on the WEC server, over using MMA on the remote systems?
Thanks for any response