MicrosoftDNSAgent extension

Question

Hello Team, I am planning install/deploy MicrosoftDNSAgent extension. I have already applied AMA policy with DCRs. now planning to choose unified method to deploy and configure MicrosoftDNSAgent extension by policy since AMA and scope specific DCR deployment is done. looking for suggestions. thank you.

Answer 1

don´t know if this helps, but spent now hours in the troubleshooting why my asim dns dcr rule wasn´t collecting logs and saw, that the extention didn´t got installed on my machines.

the way how i installed it was via powershell:

Install-module Az.ConnectedMachine

Import-module Az.ConnectedMachine

$extPublisher = "Microsoft.Sentinel.AzureMonitorAgentExtensions"

$extName = "MicrosoftDnsAgent"

new-azconnectedMachineExtension -ResourceGroupName '<RGName>' -Location 'westeurope' -MachineName '<ARCMaschineName>' -Name $extName -Publisher $extPublisher -ExtensionType $extName

Answer 2

@Naresh Babu Thanks for reaching out. As far as I know, you can set up the DNS connector in only two ways:

• Microsoft Sentinel portal. With this setup, you can create, manage, and delete a single Data Collection Rule (DCR) per workspace. Even if you define multiple DCRs via the API, the portal shows only a single DCR.
• API. With this setup, you can create, manage, and delete multiple DCRs.

Can you confirm if you are looking for a way to use already created DCR to collect the DNS logs?

Answer 3

The following Azure PowerShell worked to manually install the Microsoft DNS Agent on Azure Arc-enabled servers when automatic installation did not occur. If there is a DCR in place for the computer to send DNS logs to Azure Log Analytics the data will start to arrive: (TypeHandlerVersion is the latest version number of the extension)

New-AzConnectedMachineExtension -Name "MicrosoftDNSAgent" -ResourceGroupName "<RGname>" -MachineName "<ComputerName>" -Location "<Location>" -Publisher "Microsoft.Sentinel.AzureMonitorAgentExtensions" -ExtensionType "MicrosoftDNSAgent" -TypeHandlerVersion "1.4.4"