Splunk Enterprise Security

Why doesn't the Splunk Add-on for Microsoft Windows DNS populate the Network Resolution data model?

ejwade
Contributor

I'm not seeing the Network Resolution/DNS datamodel/dataset populated from the Splunk Add-on for Microsoft Windows DNS. The add-on was installed per the documentation on all Windows DNS servers.

Couple notes:

  • The MSAD:NT6:DNS sourcetype had one too many forward slashes. I changed the stanza from [MonitorNoHandle:///C:\TEMP...] to [MonitorNoHandle://C:\TEMP...] and then logs were getting ingested.
  • The add-on wasn't extracting anything when it was installed on ONLY DNS servers (per documentation). I had to install on indexers and search heads to get search time extraction. I recommend the documentation get updated to reflect this.
  • We are running Splunk Enterprise Security. I whitelisted "msad" in the CIM Setup to ensure the data model was looking at this index.

Thank you.
Ed

1 Solution

guarisma
Contributor

Unfortunately this Add-on doesn't match the CIM for Network Resolution DNS.
It's really strange that Splunk wouldn't make all the extractions and calculations match sowe could accelerate this data and use it with Splunk ES or Splunk Security Essentials.
You can try creating aliases and tagging the events to match the CIM Data model, but I think it should have been done out of the box by Splunk.

View solution in original post

guarisma
Contributor

Unfortunately this Add-on doesn't match the CIM for Network Resolution DNS.
It's really strange that Splunk wouldn't make all the extractions and calculations match sowe could accelerate this data and use it with Splunk ES or Splunk Security Essentials.
You can try creating aliases and tagging the events to match the CIM Data model, but I think it should have been done out of the box by Splunk.

MonkeyK
Builder

This is actually not very easy to do with the default Windows DNS logging.  Firstly, to populate the Network Resolution, one would need to correlate request and response records.  But beyond that, Microsoft logs DNS at a debug level and logs are multiple lines long and very difficult to parse.

Splunk does do the aggregation and parsing in the Stream app, but even that does not handle the datamodel mapping.  A shame really, because it is not really clear how the Network Resolution model is supposed to be used with a number of DNS return types.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...