Microsoft DHCP Server

Samurai [Local] Collector	Samurai [Cloud] Collector

Use this document to install and configure the Filebeat agent to send Microsoft DHCP Server logs to Samurai using the Samurai Local Collector deployed in your network.

To complete this Integration you will need to:

1. Ensure correct network connectivity
2. Download & Install Filebeat
3. Configure & Enable DHCP Server Audit Logging
4. Configure & Start Filebeat

Ensure correct network connectivity

You must ensure the following connectivity requirements are fulfilled:

Download & Install Filebeat

Perform the steps outlined in Step 1: Install Filebeat as per the vendor documentation.

Configure & Enable DHCP Server Audit Logging

Configure via Powershell

1. To view the DHCP Audit logging config, run the command Get-DhcpServerAuditLog.

   PS C:\> Get-DhcpServerAuditLogPath : C:\Windows\system32\dhcpEnable : TrueMaxMBFileSize : 70DiskCheckInterval : 50MinMBDiskSpace : 20
   

2. Verify that the flag Enabled is set to True.

   1. In case logging is not enabled, run the commend Set-DhcpServerAuditLog. Example command with arguments is presented below.

      PS C:\> Set-DhcpServerAuditLog -Enable $True -Path C:\dhcp
      

   2. The DHCP server needs to be restarted after logging has been enabled, run the following command to restart the service.

      PS C:\> Restart-Service DHCPServer
      

3. Note down the file path that has been configured, this will be used later in the section Configure & Start Filebeat.

Configure & Start Filebeat

1. Access the Filebeat installation folder and open and edit the file filebeat.yml.
2. Modify the below template by replacing the section IP_OF_LOCAL_COLLECTOR with the IP address of the Samurai Local Collector.
3. Modify the paths section of the template to use the path that was configured for the DHCP Server Audit log file location from Configure & Enable DHCP Server Audit Logging.

# ============================== Filebeat inputs ===============================
filebeat.inputs:
  - type: filestream
    id: win_dhcp
    enabled: true
    paths:
      - 'C:\Windows\System32\dhcp\Dhcp*'
    include_lines: ['^\d+,(\d+\/){2}\d+,.*$']
    tags: [win_dhcp_server]
#------------------------------ Logstash Output -------------------------------
output.logstash:
  hosts: ["IP_OF_LOCAL_COLLECTOR:5044"]

4. Replace the default configuration of filebeat.yml with the modified template and save the file.
5. Perform the steps outlined in Step 5: Start Filebeat as per the vendor documentation to start the service.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.