Migrating Sentinel DNS event connector from legacy agent to AMA

Question

Hi

I am in the process of migrating the Sentinel Windows security and DNS data connectors from the legacy agent to AMA.

We use the DNS audit log 519 events to resolve device names from ip addresses where the device name is not returned in a lookup query. However, the DNS events via AMA connector currently only supports analytic events, so we will no longer be receiving these audit events.

Is there another way to ingest the DNS audit events?

Otherwise is support for audit events in the roadmap for the DNS via AMA connector?

Thanks

Answer 1

@Louise Atyeo

Thank you for posting your query on Microsoft Q&A, I am currently getting the ask reviewed internally and will get back to you with further inputs.

Update 1:

Thank you for your time and patience, I was able to get this reviewed and got the following update from dev team:

As per current design DNS events via the AMA connector only support analytic events, not audit events.

However, adding the collection of Windows DNS audit events in currently on the roadmap and private preview would be out soon for customer's feedback. Currently we don't have any ETA on the availability.

If you don't have any further queries and the suggested answer is as per your business need, please "Accept the answer", This will help us and others in the community as well.

Thanks,

Akshay Kaushik