Log DNS Responses from BIND 9.10 for use with Enterprise Security

[panovattack]

I am looking for anyone who might know the appropriate BIND logging configuration to capture DNS replies so that we can map these into the Network Resolution model in Enterprise Security. Logging the queries is simple enough and the MS DNS configuration was easy to discover for our AD devices. However, I can't seem to find the right BIND logging settings without using Debug Level 10 - which is far too much data.

Any thoughts? I have not found any documentation on this - to ONLY log queries and responses in BIND.

[Splunker · Accepted solution]

You will need the ISC BIND Add-On, and specific documentation here:

http://docs.splunk.com/Documentation/AddOns/released/ISCBIND/Setup2

Cheers.

[panovattack]

We already have the add-on installed and it is mapping queries correctly. I am asking about the BIND configuration we should use. The configuration proposed on the Splunk Doc does not capture DNS response codes required by ES for DNS protocol intelligence. Does anyone know how we configure BIND to log the response codes - these packets seem to be supported by Add-On, but we can't figure out how to log them w/o Debug level 10.

[Splunker]

Not sure if it's possible (from a quick read around anyway).

You could try a different approach and use Splunk Stream, which can also run on your BIND server.

https://splunkbase.splunk.com/app/1809/

It will capture request and response codes, and you can specifically pick fields you want.

Stream also has 'config templates' for ES to populate all the ES dashboards.

Cheers.