Your SOC wants to ingest Windows DNS server logs into Microsoft Sentinel to hunt for DGA-based command-and-control activity. The DNS servers are on-premises domain controllers already onboarded to Azure Arc. You must minimize licensing costs and avoid deploying additional collector infrastructure while ensuring analytics rules can query the DNS query and response data. Which approach should you implement?