Splunk Enterprise Security

Why doesn't the Splunk Add-on for Microsoft Windows DNS populate the Network Resolution data model?

ejwade
Contributor

I'm not seeing the Network Resolution/DNS datamodel/dataset populated from the Splunk Add-on for Microsoft Windows DNS. The add-on was installed per the documentation on all Windows DNS servers.

Couple notes:

  • The MSAD:NT6:DNS sourcetype had one too many forward slashes. I changed the stanza from [MonitorNoHandle:///C:\TEMP...] to [MonitorNoHandle://C:\TEMP...] and then logs were getting ingested.
  • The add-on wasn't extracting anything when it was installed on ONLY DNS servers (per documentation). I had to install on indexers and search heads to get search time extraction. I recommend the documentation get updated to reflect this.
  • We are running Splunk Enterprise Security. I whitelisted "msad" in the CIM Setup to ensure the data model was looking at this index.

Thank you.
Ed

1 Solution

guarisma
Contributor

Unfortunately this Add-on doesn't match the CIM for Network Resolution DNS.
It's really strange that Splunk wouldn't make all the extractions and calculations match sowe could accelerate this data and use it with Splunk ES or Splunk Security Essentials.
You can try creating aliases and tagging the events to match the CIM Data model, but I think it should have been done out of the box by Splunk.

View solution in original post

guarisma
Contributor

Unfortunately this Add-on doesn't match the CIM for Network Resolution DNS.
It's really strange that Splunk wouldn't make all the extractions and calculations match sowe could accelerate this data and use it with Splunk ES or Splunk Security Essentials.
You can try creating aliases and tagging the events to match the CIM Data model, but I think it should have been done out of the box by Splunk.

MonkeyK
Builder

This is actually not very easy to do with the default Windows DNS logging.  Firstly, to populate the Network Resolution, one would need to correlate request and response records.  But beyond that, Microsoft logs DNS at a debug level and logs are multiple lines long and very difficult to parse.

Splunk does do the aggregation and parsing in the Stream app, but even that does not handle the datamodel mapping.  A shame really, because it is not really clear how the Network Resolution model is supposed to be used with a number of DNS return types.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...