Splunk Enterprise Security

Log DNS Responses from BIND 9.10 for use with Enterprise Security

panovattack
Communicator

I am looking for anyone who might know the appropriate BIND logging configuration to capture DNS replies so that we can map these into the Network Resolution model in Enterprise Security. Logging the queries is simple enough and the MS DNS configuration was easy to discover for our AD devices. However, I can't seem to find the right BIND logging settings without using Debug Level 10 - which is far too much data.

Any thoughts? I have not found any documentation on this - to ONLY log queries and responses in BIND.

1 Solution

Splunker
Communicator

You will need the ISC BIND Add-On, and specific documentation here:

http://docs.splunk.com/Documentation/AddOns/released/ISCBIND/Setup2

Cheers.

View solution in original post

0 Karma

Splunker
Communicator

You will need the ISC BIND Add-On, and specific documentation here:

http://docs.splunk.com/Documentation/AddOns/released/ISCBIND/Setup2

Cheers.

0 Karma

panovattack
Communicator

We already have the add-on installed and it is mapping queries correctly. I am asking about the BIND configuration we should use. The configuration proposed on the Splunk Doc does not capture DNS response codes required by ES for DNS protocol intelligence. Does anyone know how we configure BIND to log the response codes - these packets seem to be supported by Add-On, but we can't figure out how to log them w/o Debug level 10.

0 Karma

Splunker
Communicator

Not sure if it's possible (from a quick read around anyway).

You could try a different approach and use Splunk Stream, which can also run on your BIND server.

https://splunkbase.splunk.com/app/1809/

It will capture request and response codes, and you can specifically pick fields you want.

Stream also has 'config templates' for ES to populate all the ES dashboards.

Cheers.

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...