This is also given in the Microsoft documentation, wherein you would use the Event Table for the queries on events from Windows Virtual machines

Since this is clearly mentioned, all other options are incorrect
For more information on collecting event data from windows virtual machines, please go ahead and visit the below URL.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events