A node can be a virtual machine, a physical server, a network device or other instance. You can buy
additional nodes either upfront through a suite or by purchasing a pay-as-you-go plan.
Examples of nodes include the following:
Insight & Analytics
• Windows and Linux computers with one of the OMS agents installed
• Azure classic cloud service web and worker role instances
• Azure service fabric cluster nodes
• Data sent through the data collector API with the “Computer” field populated
• Each device sending logs via a syslog forwarder
Automation & Control
• Computers with the Configuration Management agent installed
• Computers with an OMS agent collecting Change Tracking data
• Computers with an OMS agent collecting Update Management data
• Computers with Automation Hybrid Worker installed
Security & Compliance
• Windows computers sending Security Event logs
• Linux computers sending security/authorization syslog events
• Azure resources monitored by Security Center. Note that currently, only virtual machines are counted (each Azure VM counts as one node), but as more security monitoring capabilities are
enabled for other types of services, like Azure Cloud Services or SQL databases, we may begin counting these resources as well.
• Computers sending antimalware information
• Devices sending Security logs, including:
o Windows computers sending Security Event logs
o Linux computers sending security/authorization syslog events
o Devices, such as network devices, sending Common Event Format (CEF) logs
o Devices, such as network devices, sending Cisco Adaptive Security Appliance (ASA) logs
o Each device sending the above log types through a syslog forwarde