Forum Discussion
Solved
Collecting DNS logs from multiple DNS sources and forwarding to Azure Sentinel
Hi folks,
We have a scenario where one of the client has setup a windows based Log Collector to collect DNS logs from multiple DNS servers ( I am assuming they are using wincollect). Client doesnt want to install the MMA agent on all DNS servers rather wants to have the agent installed on their Log Collector (Windows Machines used for collecting logs) and use it to forward the logs to Azure Sentinel.
I have made up simple architecture diagram to explain the same. The following are my questions:
1. Can MMA agent forward the DNS event logs to the Azure Sentinel ( I am assuming it will take all the logs in the windows event viewer and send them to Azure Sentinel)
2. There are two possibilities interms of log collection, the collected DNS logs from multiple servers will either be stored in local files or in event viewer. Incase they are in event viewer, I think MMA agent will automatically pick them up and send to sentinel?
3. Incase, they are stored in file locally on the server, which agent will be required? I dont see any option in sentinel to pick logs from custom locations?
Can any one help identifying which agent can actually pick up the logs collected and forward to sentinel.
Need some quick advise here.
Thanks
Fahad.
- Windows Event Forwarding (WEF) is supported by the AMA not MMA, please see https://docs.microsoft.com/en-us/azure/sentinel/whats-new#windows-forwarded-events-connector-now-available-public-preview
- Windows Event Forwarding (WEF) is supported by the AMA not MMA, please see https://docs.microsoft.com/en-us/azure/sentinel/whats-new#windows-forwarded-events-connector-now-available-public-preview
- Hi Mark, the client postponed this integration part. However, your proposed solution seems the best fit. Thanks anyways for your prompt input and support.
hi Clive, Thank you for the prompt response. I have gone through the link and got an idea that we need to deploy AMA agent and have Azure Arc deployed for on premise machines.
However I cannot find a quick like to download and deploy both AMA agent and Azure Arc for on-premise. Can you please share the link (much appreciated).Quick Update 1: I got how to deploy Azure Arc from the link below, now trying to explore how to get AMA installed on on-premise servers.
https://www.youtube.com/watch?v=QEU0h8BR7Yg
Quick Update 2:
From the link below, I am getting an understanding that once you install Azure Arc on on-premise server, you will be able to manage and see it through Azure portal and then we can use different deployment methods listed in the below link to install AMA on on-premise machines. (Please correct me if i am wrong)
Also please clarify if Azure Connected Machine agent = Azure Arc agent (Sorry I am new to Microsoft Technologies)
Thanks
Fahad.
