{"id":2680,"date":"2023-08-10T20:25:30","date_gmt":"2023-08-10T19:25:30","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=2680"},"modified":"2023-08-10T20:25:32","modified_gmt":"2023-08-10T19:25:32","slug":"collecting-dns-events-using-azure-monitor-agent","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=2680","title":{"rendered":"Collecting DNS events using Azure Monitor Agent"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">This blog will give you insight on how to setup collection o<strong>f DNS Events<\/strong> from <strong>Windows devices<\/strong> using <strong>Azure Monitor Agent (AMA).<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This blog-post is part of a series of blog posts to <a href=\"https:\/\/mortenknudsen.net\/?p=1687\" target=\"_blank\" rel=\"noreferrer noopener\">master Azure logging in depth (overview)<\/a>. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized is-style-default\"><a href=\"https:\/\/mortenknudsen.net\/?p=1687\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25.png\" alt=\"\" class=\"wp-image-2124\" style=\"width:434px;height:502px\" width=\"434\" height=\"502\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25.png 867w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25-259x300.png 259w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25-768x889.png 768w\" sizes=\"auto, (max-width: 434px) 100vw, 434px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get you started, you can find <a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibrary\" target=\"_blank\" rel=\"noreferrer noopener\">ARM-templates &amp; scripts in my AzureLogLibrary (github)<\/a>. Details will be covered in the articles.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibarary\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-1024x466.png\" alt=\"\" class=\"wp-image-2125\" style=\"width:400px;height:182px\" width=\"400\" height=\"182\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-1024x466.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-300x137.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-768x349.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26.png 1057w\" sizes=\"auto, (max-width: 400px) 100vw, 400px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"arm\">How to start collecting DNS events using ARM-template ?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">To get you started, check out <a href=\"https:\/\/raw.githubusercontent.com\/KnudsenMorten\/AzureLogLibrary\/main\/DataCollection\/event-logs\/dcr-windows-vmhealth-events-system_application.json\" target=\"_blank\" rel=\"noreferrer noopener\">the ARM-template<\/a> on <a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibrary\" target=\"_blank\" rel=\"noreferrer noopener\">my Github<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibrary\" target=\"_blank\" rel=\"noreferrer noopener\">I do also provide more documentation and powershell script to deploy more DCRs<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Lastly, I am also providing \u2018Deploy to Azure\u2019 shortcuts, based on the mentioned ARM-templates so you can deploy samples into your environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<a href=\"https:\/\/portal.azure.com\/#create\/Microsoft.Template\/uri\/https%3A%2F%2Fraw.githubusercontent.com%2FKnudsenMorten%2FAzureLogLibrary%2Fmain%2FDataCollection%2Fdns%2Fdcr-dns-logs.json\" target=\"_blank\" rel=\"noopener\">\n  <img decoding=\"async\" src=\"https:\/\/aka.ms\/deploytoazurebutton\">\n<\/a>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Filtering<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As you can see in the sample ARM files, I have provided some samples for filtering.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consider to adjust this according to your needs.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>\"Filters\": &#91;\n                                                            {\n                                                                \"FilterName\": \"Website\",\n                                                                \"Rules\": &#91;\n                                                                    {\n                                                                        \"Field\": \"DvcIpAddr\",\n                                                                        \"FieldValues\": &#91;\n                                                                            \"123.123.123.123\"\n                                                                        ]\n                                                                    }\n                                                                ]\n                                                            },\n                                                            {\n                                                                \"FilterName\": \"Exclude_MyCompany_Queries\",\n                                                                \"Rules\": &#91;\n                                                                    {\n                                                                        \"Field\": \"DnsQuery\",\n                                                                        \"FieldValues\": &#91;\n                                                                            \"mycompanyname.com\"\n                                                                        ]\n                                                                    }\n                                                                ]\n                                                            },\n                                                            {\n                                                                \"FilterName\": \"Recurse_Query_Out\",\n                                                                \"Rules\": &#91;\n                                                                    {\n                                                                        \"Field\": \"EventOriginalType\",\n                                                                        \"FieldValues\": &#91;\n                                                                            \"260\"\n                                                                        ]\n                                                                    }\n                                                                ]<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>{\r\n    \"$schema\": \"http:\/\/schema.management.azure.com\/schemas\/2015-01-01\/deploymentTemplate.json#\",\r\n    \"contentVersion\": \"1.0.0.0\",\r\n    \"parameters\": {\r\n        \"WorkspaceResourceId\": {\r\n            \"type\": \"String\",\r\n            \"metadata\": {\r\n                \"description\": \"LogAnalytics Workspace Resource ID\"\r\n            }\r\n        },\r\n        \"WorkspaceLocation\": {\r\n            \"type\": \"String\",\r\n            \"metadata\": {\r\n                \"description\": \"LogAnalytics Workspace Location (e.g. westeurope)\"\r\n            }\r\n        },\r\n        \"DcrName\": {\r\n            \"type\": \"String\",\r\n            \"metadata\": {\r\n                \"description\": \"Data Collection Rule name\"\r\n            }\r\n        },\r\n        \"DcrResourceGroup\": {\r\n            \"type\": \"String\",\r\n            \"metadata\": {\r\n                \"description\": \"Data Collection Rule resource group\"\r\n            }\r\n\t\t}\r\n    },\r\n    \"variables\": {},\r\n    \"resources\": &#91;\r\n        {\r\n            \"type\": \"Microsoft.Resources\/deployments\",\r\n            \"apiVersion\": \"2017-05-10\",\r\n            \"name\": \"&#91;parameters('DcrName')]\",\r\n            \"properties\": {\r\n                \"mode\": \"Incremental\",\r\n                \"template\": {\r\n                    \"$schema\": \"https:\/\/schema.management.azure.com\/schemas\/2015-01-01\/deploymentTemplate.json#\",\r\n                    \"contentVersion\": \"1.0.0.0\",\r\n                    \"parameters\": {},\r\n                    \"variables\": {},\r\n                    \"resources\": &#91;\r\n                        {\r\n                            \"type\": \"Microsoft.Insights\/dataCollectionRules\",\r\n                            \"apiVersion\": \"2021-04-01\",\r\n                            \"name\": \"&#91;parameters('DcrName')]\",\r\n                            \"location\": \"&#91;parameters('WorkspaceLocation')]\",\r\n                            \"properties\": {\r\n                                \"description\": \"Data collection rule for VM Insights.\",\r\n                                \"dataSources\": {\r\n                                    \"extensions\": &#91;\r\n                                                {\r\n                                                    \"streams\": &#91;\r\n                                                        \"Microsoft-ASimDnsActivityLogs\"\r\n                                                    ],\r\n                                                    \"extensionName\": \"MicrosoftDnsAgent\",\r\n                                                    \"extensionSettings\": {\r\n                                                        \"Filters\": &#91;\r\n                                                            {\r\n                                                                \"FilterName\": \"Website\",\r\n                                                                \"Rules\": &#91;\r\n                                                                    {\r\n                                                                        \"Field\": \"DvcIpAddr\",\r\n                                                                        \"FieldValues\": &#91;\r\n                                                                            \"123.123.123.123\"\r\n                                                                        ]\r\n                                                                    }\r\n                                                                ]\r\n                                                            },\r\n                                                            {\r\n                                                                \"FilterName\": \"Exclude_MyCompany_Queries\",\r\n                                                                \"Rules\": &#91;\r\n                                                                    {\r\n                                                                        \"Field\": \"DnsQuery\",\r\n                                                                        \"FieldValues\": &#91;\r\n                                                                            \"mycompanyname.com\"\r\n                                                                        ]\r\n                                                                    }\r\n                                                                ]\r\n                                                            },\r\n                                                            {\r\n                                                                \"FilterName\": \"Recurse_Query_Out\",\r\n                                                                \"Rules\": &#91;\r\n                                                                    {\r\n                                                                        \"Field\": \"EventOriginalType\",\r\n                                                                        \"FieldValues\": &#91;\r\n                                                                            \"260\"\r\n                                                                        ]\r\n                                                                    }\r\n                                                                ]\r\n                                                            }\r\n                                                        ]\r\n                                                    },\r\n                                                    \"name\": \"ASimDnsActivityLogsTypeExtension\"\r\n\t\t\t\t\t\t\t\t\t\t        }\r\n                                    ]\r\n                                },\r\n                                \"destinations\": {\r\n                                    \"logAnalytics\": &#91;\r\n                                        {\r\n                                            \"workspaceResourceId\": \"&#91;parameters('WorkspaceResourceId')]\",\r\n                                            \"name\": \"DnsDataCollection\"\r\n                                        }\r\n                                    ]\r\n                                },\r\n                                \"dataFlows\": &#91;\r\n                                    {\r\n                                        \"streams\": &#91;\r\n                                            \"Microsoft-ASimDnsActivityLogs\"\r\n                                        ],\r\n                                        \"destinations\": &#91;\r\n                                            \"DnsDataCollection\"\r\n                                        ]\r\n                                    }\r\n                                ]\r\n                            }\r\n                        }\r\n                    ]\r\n                }\r\n            },\r\n            \"subscriptionId\": \"&#91;split(parameters('WorkspaceResourceId'),'\/')&#91;2]]\",\r\n            \"resourceGroup\": \"&#91;parameters('DcrResourceGroup')]\"\r\n\t\t}\r\n    ],\r\n    \"outputs\": {}\r\n}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>This blog will give you insight on how to setup collection of DNS Events from Windows devices using Azure Monitor &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Collecting DNS events using Azure Monitor Agent\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=2680#more-2680\" aria-label=\"Read more about Collecting DNS events using Azure Monitor Agent\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":2050,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[140,55,59,129,131,61,128,54,143,141,57,28,139,136,138,137,142,133,134,146,60,132,58,145,135,144],"tags":[],"class_list":["post-2680","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ama","category-azure","category-azure-arc","category-azure-data-collection-rules","category-azure-data-ingestion-pipeline","category-azure-extensions","category-azure-log-ingestion-api","category-azure-loganalytics","category-azure-logging","category-azure-monitor-agent","category-azure-security","category-community","category-data-collection-endpoint","category-data-transformation","category-dce","category-dcr","category-logging","category-microsoft-security","category-mvpbuzz","category-performance-collection","category-scripting","category-security","category-sentinel","category-servicemap","category-transformation","category-vminsight","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/event.png","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/event.png","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/2680","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2680"}],"version-history":[{"count":2,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/2680\/revisions"}],"predecessor-version":[{"id":2682,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/2680\/revisions\/2682"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/2050"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2680"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2680"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}