topic Re: How to add Windows DHCP logs to enrich Assets data in Cortex XDR Discussions

How to add Windows DHCP logs to enrich Assets data

PhyoWaiSoe — Wed, 20 Dec 2023 17:34:27 GMT

Hi Everyone,

I am totally new to Cortex XDR and trying out the latest Pro version. What I wish to do is simple and I saw others discussed about it. But I really really need clear instructions on how to do that. In the All Assets list, we wish to get more information about assets that don't have XDR agent installed, besides their IP addresses. It would be good to know their system names, OS and MAC address.

After reading much documentation and forum posts, I already enabled Agent and Broker ping scans but they only return IP addresses.

I figured the best way is to install an XDR collector on the DHCP server(we are using a Windows Server) that we have and analyze DHCP logs with Filebeat. I followed all the steps in the documentation but it's still showing IP addresses only. When I create an XDR Collector installer, does it also include Filebeat or Filebeat package has to be installed on the DHCP server separately? How does one know if/when XDR Collector or Filebeat is reading DHCP logs or not?

Thank you.

Re: How to add Windows DHCP logs to enrich Assets data

nsinghvirk — Fri, 22 Dec 2023 15:45:50 GMT

Hello @PhyoWaiSoe

Thanks for reaching out on LiveCommunity!

XDR collector already contains the Filebeat package, you do not need to install it separately. To check incoming data please ensure that XDR collector is in connected state. Then you can use XQL query language to query data to following datasets.

For Filebeat, the app automatically creates an Cortex Query Language (XQL) dataset of event logs using the vendor name and the product name specified in the configuration file section of the Filebeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset in the format <module>_<module>_raw or <input>_<input>_raw. For example, if you are using the NGINX module, the dataset is called nginx_nginx_raw.
For Winlogbeat, the app automatically creates an XQL dataset of event logs using the vendor name and the product name specified in the configuration file section of the Winlogbeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset, microsoft_windows_raw, for event log collection.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: How to add Windows DHCP logs to enrich Assets data

PhyoWaiSoe — Fri, 22 Dec 2023 15:55:51 GMT

Thank you so much for this insightful reply.