I am looking for anyone who might know the appropriate BIND logging configuration to capture DNS replies so that we can map these into the Network Resolution model in Enterprise Security. Logging the queries is simple enough and the MS DNS configuration was easy to discover for our AD devices. However, I can't seem to find the right BIND logging settings without using Debug Level 10 - which is far too much data.
Any thoughts? I have not found any documentation on this - to ONLY log queries and responses in BIND.
We already have the add-on installed and it is mapping queries correctly. I am asking about the BIND configuration we should use. The configuration proposed on the Splunk Doc does not capture DNS response codes required by ES for DNS protocol intelligence. Does anyone know how we configure BIND to log the response codes - these packets seem to be supported by Add-On, but we can't figure out how to log them w/o Debug level 10.