windows DHCP server logs to Sentinel

[roadruner]

Does anyone know how to ingest Windows DHCP server logs to Sentinel ?

thanks

[#2 · Accepted solution]

One way is to install the Microsoft Monitoring agent on the servers and then in Azure Sentinel go to Settings => Workspace settings => Advanced Settings => Data and in the Windows Event Logs, select any of the DHCP event logs you want to ingest

[#3]

thanks , i saw a similar solution via this url .. i’ll give it a whirl and see what happens
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events

[#4]

hi, would this be for on prem servers or servers in azure. or both ? how does sentinel know which servers to pull data from ? or is it capturing dhcp events from anywhere? thanks

[#5]

@roadruner This would work for either Azure or non-Azure computers.  If you set up the Data section to ingest the DHCP events logs, then this would apply to all Windows computers.  So the agent would look for those logs on all windows computers, although it should only find them on DHCP servers.

There is a new monitoring agent in public preview that would allow you to specify what logs to look at on which computers but it only works for Azure computers for the most part.

[#6]

great thanks , i take it i would see these dhcp logs , under Log Management/Event in Sentinel ?

[#7]

That is correct

[#8]

I'm trying to consume Microsoft-Windows-Dhcp-Server/AuditLog but nothing is coming in, even though the dhcp audit file is populating

[#9]

@guarismoI have the same thing also.

[#10]

@roadruner 

Please check the article I wrote to ingest DHCP logs using the new AMA agent.
 https://medium.com/@johnnymonz/how-to-ingest-windows-server-dhcp-logs-in-microsoft-sentinel-e363be9f...