|
| 1 | +# Agent Integration: Microsoft DNS |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +[Microsoft DNS][4] is a Windows Server service that translates domain names into IP addresses, allowing computers to find and communicate with each other on a network. It supports features like Dynamic DNS (DDNS), zone transfers, conditional forwarding, DNSSEC for security, and scavenging to remove stale records. |
| 6 | + |
| 7 | +This integration collects and enhances [DNS Server audit events][5], providing detailed insights through out-of-the-box dashboards. It also includes ready-to-use Cloud SIEM detection rules for improved monitoring and security. |
| 8 | + |
| 9 | +## Setup |
| 10 | + |
| 11 | +### Installation |
| 12 | + |
| 13 | +To install the Microsoft DNS integration, run the following Agent installation command and the steps below. For more information, see the [Integration Management][6] documentation. |
| 14 | + |
| 15 | +**Note**: This step is not necessary for Agent version >= 7.66.0. |
| 16 | + |
| 17 | +Run powershell.exe as admin and execute following command: |
| 18 | + ```powershell |
| 19 | + & "$env:ProgramFiles\Datadog\Datadog Agent\bin\agent.exe" integration install datadog-microsoft_dns==1.0.0 |
| 20 | + ``` |
| 21 | + |
| 22 | +### Configuration |
| 23 | + |
| 24 | +#### Configure Log Collection |
| 25 | + |
| 26 | +1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the `datadog.yaml` file with: |
| 27 | + |
| 28 | + ```yaml |
| 29 | + logs_enabled: true |
| 30 | + ``` |
| 31 | +
|
| 32 | +2. Add this configuration block to your `microsoft_dns.d/conf.yaml` file to start collecting your Microsoft DNS Server audit events: |
| 33 | + |
| 34 | + ```yaml |
| 35 | + logs: |
| 36 | + - type: windows_event |
| 37 | + channel_path: "Microsoft-Windows-DNSServer/Audit" |
| 38 | + source: microsoft-dns |
| 39 | + service: microsoft-dns |
| 40 | + sourcecategory: windowsevent |
| 41 | + ``` |
| 42 | + |
| 43 | +3. [Restart the Agent][3]. |
| 44 | + |
| 45 | +### Validation |
| 46 | + |
| 47 | +[Run the Agent's status subcommand][7] and look for `microsoft_dns` under the Checks section. |
| 48 | + |
| 49 | +## Data Collected |
| 50 | + |
| 51 | +### Logs |
| 52 | + |
| 53 | +The Microsoft DNS integration collects the [DNS Server audit events][5]. |
| 54 | + |
| 55 | +### Metrics |
| 56 | + |
| 57 | +The Microsoft DNS integration does not include any metrics. |
| 58 | + |
| 59 | +### Events |
| 60 | + |
| 61 | +The Microsoft DNS integration does not include any events. |
| 62 | + |
| 63 | +### Service Checks |
| 64 | + |
| 65 | +The Microsoft DNS integration does not include any service checks. |
| 66 | + |
| 67 | +## Support |
| 68 | + |
| 69 | +Need help? Contact [Datadog support][1]. |
| 70 | + |
| 71 | +[1]: https://docs.datadoghq.com/help/ |
| 72 | +[2]: https://app.datadoghq.com/account/settings/agent/latest |
| 73 | +[3]: https://docs.datadoghq.com/agent/configuration/agent-commands/#restart-the-agent |
| 74 | +[4]: https://learn.microsoft.com/en-us/windows-server/networking/dns/dns-overview |
| 75 | +[5]: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn800669(v=ws.11)#audit-events |
| 76 | +[6]: https://docs.datadoghq.com/agent/guide/integration-management/?tab=windowspowershell#install |
| 77 | +[7]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information |
0 commit comments