[E]
The Azure Connected Machine Agent (Arc Agent) works with the Azure Monitor Agent (AMA) to get data into Microsoft Sentinel, but the AMA is the primary agent for log collection, using the Arc Agent to extend Azure management to hybrid machines; they aren't the same, but complementary. The Arc Agent connects servers (on-prem, other clouds) to Azure as if they were Azure VMs, then the AMA (installed as an extension) collects security logs (like Syslog/Windows Events) from these Arc-enabled machines and sends them to Sentinel.
[F]
Collect Windows events from virtual machine with Azure Monitor
Windows event logs are some of the most common sources for health of the client operating system and workloads of Windows machines. You can collect events from standard logs, such as System and Application, and any custom logs created by applications you need to monitor.
Collect Windows event logs from virtual machines using a data collection rule (DCR) with a Windows events data source.
Reference:
https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview
https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events