Forum Discussion
windows DHCP server logs to Sentinel
Does anyone know how to ingest Windows DHCP server logs to Sentinel ? thanks
- One way is to install the Microsoft Monitoring agent on the servers and then in Azure Sentinel go to Settings => Workspace settings => Advanced Settings => Data and in the Windows Event Logs, select any of the DHCP event logs you want to ingest
roadruner This would work for either Azure or non-Azure computers. If you set up the Data section to ingest the DHCP events logs, then this would apply to all Windows computers. So the agent would look for those logs on all windows computers, although it should only find them on DHCP servers.
There is a new monitoring agent in public preview that would allow you to specify what logs to look at on which computers but it only works for Azure computers for the most part.
great thanks , i take it i would see these dhcp logs , under Log Management/Event in Sentinel ?
