topic collect DNS logs in Security

collect DNS logs

hazem — Wed, 30 Oct 2024 10:15:50 GMT

Hello,

How to collect DNS logs from Active Directory where the domain controllers have a DNS role

Re: collect DNS logs

gcusello — Wed, 30 Oct 2024 10:24:13 GMT

Hi @hazem ,

use the Splunk_TA_Windows (https://splunkbase.splunk.com/app/742) enabling the relatiove stanzas.

Ciao.

Giuseppe

Re: collect DNS logs

hazem — Wed, 30 Oct 2024 10:47:21 GMT

Hi @gcusello ,

did you mean that should need to enable the below stanza:

###### Monitor Inputs for DNS ######
[MonitorNoHandle://$WINDIR\System32\Dns\dns.log]
sourcetype=MSAD:NT6:DNS
disabled=1

"While monitoring DNS logs directly with Splunk Universal Forwarder is effective, some articles suggest using Splunk Stream Forwarder apps to enhance log efficiency and analysis capabilities.

what is the best practice?

Re: collect DNS logs

gcusello — Thu, 31 Oct 2024 07:04:37 GMT

Hi @hazem ,

Splunk Stream is a packet capture app, for my knowledge isn't the best solution for DNS logs, I usually use Splunk_TA_Windows add-on.

Ciao.

Giuseppe

Re: collect DNS logs

gcusello — Sun, 03 Nov 2024 15:40:34 GMT

Hi @hazem ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉