Splunk Enterprise Security

Log DNS Responses from BIND 9.10 for use with Enterprise Security

panovattack
Communicator

I am looking for anyone who might know the appropriate BIND logging configuration to capture DNS replies so that we can map these into the Network Resolution model in Enterprise Security. Logging the queries is simple enough and the MS DNS configuration was easy to discover for our AD devices. However, I can't seem to find the right BIND logging settings without using Debug Level 10 - which is far too much data.

Any thoughts? I have not found any documentation on this - to ONLY log queries and responses in BIND.

1 Solution

Splunker
Communicator

You will need the ISC BIND Add-On, and specific documentation here:

http://docs.splunk.com/Documentation/AddOns/released/ISCBIND/Setup2

Cheers.

View solution in original post

0 Karma

Splunker
Communicator

You will need the ISC BIND Add-On, and specific documentation here:

http://docs.splunk.com/Documentation/AddOns/released/ISCBIND/Setup2

Cheers.

View solution in original post

0 Karma

panovattack
Communicator

We already have the add-on installed and it is mapping queries correctly. I am asking about the BIND configuration we should use. The configuration proposed on the Splunk Doc does not capture DNS response codes required by ES for DNS protocol intelligence. Does anyone know how we configure BIND to log the response codes - these packets seem to be supported by Add-On, but we can't figure out how to log them w/o Debug level 10.

0 Karma

Splunker
Communicator

Not sure if it's possible (from a quick read around anyway).

You could try a different approach and use Splunk Stream, which can also run on your BIND server.

https://splunkbase.splunk.com/app/1809/

It will capture request and response codes, and you can specifically pick fields you want.

Stream also has 'config templates' for ES to populate all the ES dashboards.

Cheers.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.