windows DHCP server logs to Sentinel

[roadruner]

Does anyone know how to ingest Windows DHCP server logs to Sentinel ?

thanks

[#2 · Accepted solution]

One way is to install the Microsoft Monitoring agent on the servers and then in Azure Sentinel go to Settings => Workspace settings => Advanced Settings => Data and in the Windows Event Logs, select any of the DHCP event logs you want to ingest

[#3]

thanks , i saw a similar solution via this url .. i’ll give it a whirl and see what happens
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events

[#4]

hi, would this be for on prem servers or servers in azure. or both ? how does sentinel know which servers to pull data from ? or is it capturing dhcp events from anywhere? thanks

[#5]

@roadruner This would work for either Azure or non-Azure computers.  If you set up the Data section to ingest the DHCP events logs, then this would apply to all Windows computers.  So the agent would look for those logs on all windows computers, although it should only find them on DHCP servers.

There is a new monitoring agent in public preview that would allow you to specify what logs to look at on which computers but it only works for Azure computers for the most part.

[#6]

great thanks , i take it i would see these dhcp logs , under Log Management/Event in Sentinel ?

[#7]

That is correct