Server in DMZ to Internal DNS Servers - Threat Detection

[faizshir]

Hi,

We have permitted some firewall rules from Public DMZ to internal services including our DNS servers. While, we are in a process to host a DNS server dedicated for DMZ devices, we need to monitor any suspicious activity from any device directed towards the internal DNS server.

What is the best way to achieve this? We looked for rules in Splunk Security Essentials but they didn't really help. 

[PickleRick]

This is not really a Splunk question as such. It's more a general security-oriented question about what to monitor and how.

It depends on what you have in your network and what kind of information you can get from your infrastructure. Because first step to analyzing data is making sure that you have the relevant data. You can't detect something from firewall logs or IPS logs if you don't have those logs.