How to add Windows DHCP logs to enrich Assets data

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

How to add Windows DHCP logs to enrich Assets data

L1 Bithead

Hi Everyone,

I am totally new to Cortex XDR and trying out the latest Pro version. What I wish to do is simple and I saw others discussed about it. But I really really need clear instructions on how to do that. In the All Assets list, we wish to get more information about assets that don't have XDR agent installed, besides their IP addresses. It would be good to know their system names, OS and MAC address.

 

After reading much documentation and forum posts, I already enabled Agent and Broker ping scans but they only return IP addresses.

I figured the best way is to install an XDR collector on the DHCP server(we are using a Windows Server) that we have and analyze DHCP logs with Filebeat. I followed all the steps in the documentation but it's still showing IP addresses only. When I create an XDR Collector installer, does it also include Filebeat or Filebeat package has to be installed on the DHCP server separately? How does one know if/when XDR Collector or Filebeat is reading DHCP logs or not?

Thank you.

1 accepted solution

Accepted Solutions

L4 Transporter

Hello @PhyoWaiSoe 

 

Thanks for reaching out on LiveCommunity!

XDR collector already contains the Filebeat package, you do not need to install it separately. To check incoming data please ensure that XDR collector is in connected state. Then you can use XQL query language to query data to following datasets.

  • For Filebeat, the app automatically creates an Cortex Query Language (XQL) dataset of event logs using the vendor name and the product name specified in the configuration file section of the Filebeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset in the format <module>_<module>_raw or <input>_<input>_raw. For example, if you are using the NGINX module, the dataset is called nginx_nginx_raw.

  • For Winlogbeat, the app automatically creates an XQL dataset of event logs using the vendor name and the product name specified in the configuration file section of the Winlogbeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset, microsoft_windows_raw, for event log collection.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

View solution in original post

2 REPLIES 2

L4 Transporter

Hello @PhyoWaiSoe 

 

Thanks for reaching out on LiveCommunity!

XDR collector already contains the Filebeat package, you do not need to install it separately. To check incoming data please ensure that XDR collector is in connected state. Then you can use XQL query language to query data to following datasets.

  • For Filebeat, the app automatically creates an Cortex Query Language (XQL) dataset of event logs using the vendor name and the product name specified in the configuration file section of the Filebeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset in the format <module>_<module>_raw or <input>_<input>_raw. For example, if you are using the NGINX module, the dataset is called nginx_nginx_raw.

  • For Winlogbeat, the app automatically creates an XQL dataset of event logs using the vendor name and the product name specified in the configuration file section of the Winlogbeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset, microsoft_windows_raw, for event log collection.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Thank you so much for this insightful reply.

  • 1 accepted solution
  • 458 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!