MicrosoftDNSAgent extension

Question

Hello Team, I am planning install/deploy MicrosoftDNSAgent extension. I have already applied AMA policy with DCRs. now planning to choose unified method to deploy and configure MicrosoftDNSAgent extension by policy since AMA and scope specific DCR deployment is done. looking for suggestions. thank you.

Answer 1

@Naresh Babu Thanks for reaching out. As far as I know, you can set up the DNS connector in only two ways:

• Microsoft Sentinel portal. With this setup, you can create, manage, and delete a single Data Collection Rule (DCR) per workspace. Even if you define multiple DCRs via the API, the portal shows only a single DCR.
• API. With this setup, you can create, manage, and delete multiple DCRs.

Can you confirm if you are looking for a way to use already created DCR to collect the DNS logs?

Answer 2

don´t know if this helps, but spent now hours in the troubleshooting why my asim dns dcr rule wasn´t collecting logs and saw, that the extention didn´t got installed on my machines.

the way how i installed it was via powershell:

Install-module Az.ConnectedMachine

Import-module Az.ConnectedMachine

$extPublisher = "Microsoft.Sentinel.AzureMonitorAgentExtensions"

$extName = "MicrosoftDnsAgent"

new-azconnectedMachineExtension -ResourceGroupName '<RGName>' -Location 'westeurope' -MachineName '<ARCMaschineName>' -Name $extName -Publisher $extPublisher -ExtensionType $extName