Splunk Enterprise Security

Log DNS Responses from BIND 9.10 for use with Enterprise Security

panovattack
Communicator

I am looking for anyone who might know the appropriate BIND logging configuration to capture DNS replies so that we can map these into the Network Resolution model in Enterprise Security. Logging the queries is simple enough and the MS DNS configuration was easy to discover for our AD devices. However, I can't seem to find the right BIND logging settings without using Debug Level 10 - which is far too much data.

Any thoughts? I have not found any documentation on this - to ONLY log queries and responses in BIND.

1 Solution

Splunker
Communicator

You will need the ISC BIND Add-On, and specific documentation here:

http://docs.splunk.com/Documentation/AddOns/released/ISCBIND/Setup2

Cheers.

View solution in original post

0 Karma

Splunker
Communicator

You will need the ISC BIND Add-On, and specific documentation here:

http://docs.splunk.com/Documentation/AddOns/released/ISCBIND/Setup2

Cheers.

0 Karma

panovattack
Communicator

We already have the add-on installed and it is mapping queries correctly. I am asking about the BIND configuration we should use. The configuration proposed on the Splunk Doc does not capture DNS response codes required by ES for DNS protocol intelligence. Does anyone know how we configure BIND to log the response codes - these packets seem to be supported by Add-On, but we can't figure out how to log them w/o Debug level 10.

0 Karma

Splunker
Communicator

Not sure if it's possible (from a quick read around anyway).

You could try a different approach and use Splunk Stream, which can also run on your BIND server.

https://splunkbase.splunk.com/app/1809/

It will capture request and response codes, and you can specifically pick fields you want.

Stream also has 'config templates' for ES to populate all the ES dashboards.

Cheers.

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...