topic Re: Ingest DHCP logs using XDR collector in Cortex XDR Discussions

Ingest DHCP logs using XDR collector

PeterBengtslin — Thu, 18 Apr 2024 18:43:54 GMT

Hi,

I am having issues with ingesting DHCP log from our DCs. We are using the XDR Collector app. I suspect that the issue is with the filebeat.yml file but cannot figure out what the problem is. I have tried and followed the guide below and copy-paste the example code but no logs are showing up. The yml has been checked and the syntax is correct.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-collectors/add-a-xdr-collector-profile/ingest-logs-from-windows-dhcp#id4506c349-4398-4c76-bcfc-8ef16f7c0050_id4862f7d3-1e69-4432-abac-8de40c656b86

Is there anyone that has successfully managed to ingest those logs?

Thanks!

Re: Ingest DHCP logs using XDR collector

bbarmanroy — Fri, 29 Jul 2022 01:58:48 GMT

Hi @PeterBengtslin have you checked if the path to the DHCP logs are valid? Is the issue persistent if you use a filebeat collector?

Re: Ingest DHCP logs using XDR collector

PeterBengtslin — Tue, 09 Aug 2022 12:27:41 GMT

Hi @bbarmanroy Thank you for your reply. The path is valid but there is something in the filebeat configuraion that is causing it to inactivate the service. I have been doing some labs on this and found out that this configuration is giving an acceptable result:

filebeat.inputs:

- type: log

enabled: true

paths:

- c:\Windows\System32\dhcp\DhcpSrvLog*.log

processors:

- add_fields:

fields:

vendor: "microsoft"

product: "dhcp"

- drop_event.when.not.regexp.message: "^[0-9]+,.*"

- dissect:

tokenizer: "%{id},%{date},%{time},%{description},%{ipAddress},%{hostName},%{macAddress},%{userName},%{transactionID},%{qResult},%{probationTime},%{correlationID},%{dhcid},%{vendorClassHex},%{vendorClassASCII},%{userClassHex},%{userClassASCII},%{relayAgentInformation},%{dnsRegError}"

This will store the information in dataset microsoft_dhcp_raw and the content will be split into fields defined in the tokenizer statement.

Best regards,

Peter

Re: Ingest DHCP logs using XDR collector

Honza_Linhart — Sat, 15 Oct 2022 10:55:17 GMT

Hi, I found the problem causing service inactivation. There is a \n inserted between "tokenizer:" and its parameter that has to be removed. The result has to be on one line.

Re: Ingest DHCP logs using XDR collector

KarlHalpin — Fri, 28 Oct 2022 11:15:38 GMT

Hi Peter,

I had this issue with the the collector as well and thought it was the yml file also.

I thought when you install the collector it installs the file beat service with it but it dosent.

I had to go to C: > Program data>XDR Collector > Content > filebeat-windows-x86_64 run the install-service-filebeat from powershell and then start the service from powershell as well.

Once i did that it worked for me.

Re: Ingest DHCP logs using XDR collector

JahidAliyev — Fri, 02 Feb 2024 07:15:09 GMT

Hello,
I created XDR collector package and installed it on my windows server. But it does not show up on Administration tab where i am supposed to see all xdr collector agent lists. What can be the reason for this?

Re: Ingest DHCP logs using XDR collector

Honza_Linhart — Fri, 02 Feb 2024 10:11:57 GMT

Hello @JahidAliyev

this looks like communication issue - server (XDR collector on the server) is not able to reach XDR management console. Try to check FW outbound rules (local FW on the server and any FW in the path to XDR management).

Re: Ingest DHCP logs using XDR collector

JahidAliyev — Fri, 02 Feb 2024 10:13:41 GMT

When I am in organization network, it cannot communicate. When I am using my own internet, it directly connected. If I switch to my organization network, will it be disconnected again?

Re: Ingest DHCP logs using XDR collector

JahidAliyev — Fri, 02 Feb 2024 10:15:25 GMT

And, do I need to write parsing rules or Cortex XDR will automatically bring DHCP logs under "dhcp" dataset?

Re: Ingest DHCP logs using XDR collector

JahidAliyev — Fri, 02 Feb 2024 10:16:26 GMT

@Honza_Linhart If you answer these two, I would be so happy

Re: Ingest DHCP logs using XDR collector

Honza_Linhart — Fri, 02 Feb 2024 11:23:11 GMT

For proper function, you need XDR collector connected to XDR management console all the time. You're using this connection to ingest data from on-premise server to cloud data lake. So yes, if you put it back to the network that doesn't allow connection, it will be disconnected again.

If you will have your XDR collector up and connected, use config file mentioned in this thread and you will get your DHCP logs into new dataset in Cortex XDR. There is no need to write your own parsers.

Re: Ingest DHCP logs using XDR collector

JahidAliyev — Fri, 02 Feb 2024 11:31:31 GMT

@Honza_Linhart Surprisingly, when I connect back to my organzition network, it does not become disconnected.

If I use this as config file, what will be the name of dataset if I want to look at these logs on queries?

And, is it okey to install this collector agent on any windows or we need to install it on DC and DHCP server? Because I simply installed it on usual endpoint which is not DC or DHCP server.