Ingest DHCP logs using XDR collector

[PeterBengtslin]

Hi,

I am having issues with ingesting DHCP log from our DCs. We are using the XDR Collector app. I suspect that the issue is with the filebeat.yml file but cannot figure out what the problem is. I have tried and followed the guide below and copy-paste the example code but no logs are showing up. The yml has been checked and the syntax is correct. 

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-collectors/add-a...

Is there anyone that has successfully managed to ingest those logs? 

Thanks!

[bbarmanroy]

Hi @PeterBengtslin have you checked if the path to the DHCP logs are valid? Is the issue persistent if you use a filebeat collector?

[PeterBengtslin · Accepted solution]

Hi @bbarmanroy Thank you for your reply. The path is valid but there is something in the filebeat configuraion that is causing it to inactivate the service. I have been doing some labs on this and found out that this configuration is giving an acceptable result: 

filebeat.inputs:

  - type: log

    enabled: true

    paths:

      - c:\Windows\System32\dhcp\DhcpSrvLog*.log

processors:

  - add_fields:

      fields: 

        vendor: "microsoft"

        product: "dhcp"

  - drop_event.when.not.regexp.message: "^[0-9]+,.*"

  - dissect: 

      tokenizer: "%{id},%{date},%{time},%{description},%{ipAddress},%{hostName},%{macAddress},%{userName},%{transactionID},%{qResult},%{probationTime},%{correlationID},%{dhcid},%{vendorClassHex},%{vendorClassASCII},%{userClassHex},%{userClassASCII},%{relayAgentInformation},%{dnsRegError}"

This will store the information in dataset microsoft_dhcp_raw and the content will be split into fields defined in the tokenizer statement. 

Best regards,

Peter

[Honza_Linhart]

Hi, I found the problem causing service inactivation. There is a \n inserted between "tokenizer:" and its parameter that has to be removed. The result has to be on one line.

[KarlHalpin]

Hi Peter,

I had this issue with the the collector as well and thought it was the yml file also.

I thought when you install the collector it installs the file beat service with it but it dosent.

I had to go to C: > Program data>XDR Collector > Content > filebeat-windows-x86_64  run the install-service-filebeat from powershell and then start the service from powershell as well.

Once i did that it worked for me.