Collect Microsoft Windows DNS data
This document:
- Describes the deployment architecture and installation steps, plus any required configuration that produce logs supported by the Chronicle Parser for Microsoft Windows DNS events. For an overview of Chronicle data ingestion, see Data ingestion to Chronicle.
- Includes information about how the parser maps fields in the original log to Chronicle Unified Data Model fields.
Information in this document applies to the parser with the WINDOWS_DNS ingestion label. The ingestion label identifies which parser normalizes raw log data to structured UDM format.
Before you begin
Review the recommended deployment architecture.
The following diagram illustrates the recommended core components in a deployment architecture to collect and send Microsoft Windows DNS events to Chronicle. Compare this information with your environment to be sure these components are installed. Each customer deployment will differ from this representation and may be more complex. The following is required:
- Microsoft Windows DNS Server with DNS diagnostic logging enabled.
- All systems configured with the UTC time zone.
- NXLog installed on clustered Microsoft Windows servers to collect and forward logs to the central Microsoft Windows or Linux server.
- Chronicle forwarder installed on the central Microsoft Windows or Linux Server.
Review the supported devices and versions.
The Chronicle parser supports logs from the following Microsoft Windows Server versions. Microsoft Windows Server is released with the following editions: Foundation, Essentials, Standard, and Datacenter. The event schema of logs generated by each edition do not differ.
- Microsoft Windows Server 2019
- Microsoft Windows Server 2016
- Microsoft Windows Server 2012 R2
Chronicle parser supports logs collected by NXLog Enterprise Edition.
Review the supported log types. The Chronicle parser supports the following log types generated by Microsoft Windows DNS servers. For more information about these log types, see the Microsoft Windows DNS Logging and Diagnostic documentation. It supports logs generated with English language text and is not supported with logs generated in non-English languages.
- Audit logs: For a description of this log type, see the Microsoft Windows Audit logs documentation.
- Analytics logs: For a description of this log type, see the Microsoft Windows Analytics logs documentation.
Set up the Microsoft Windows DNS servers. See the Microsoft Windows documentation for information about installing and enabling DNS diagnostic logging.
Install and configure the Central Windows or Linux server.
Configure all systems with the UTC time zone.
Configure NXLog and Chronicle forwarder
- Install NXLog on each Microsoft Windows DNS server. Follow the NXLog documentation.
Create a configuration file for each NXLog instance. Use the im_etw input module for extracting DNS analytical logs and im_msvistalog input module for audit logs.
- For more information about the im_etw input module, see Event Tracing for Microsoft Windows (im_etw), including information about configuring NXLog for Microsoft Windows DNS.
- For more information about the im_msvistalog input module, see Event log for Microsoft Windows 2008/Vista and later (im_msvistalog).
Here is an example NXLog configuration. Replace
<hostname>and<port>values with information about the central Microsoft Windows or Linux server. To optionally convert and parse logs to JSON, rather than XML, change the lineExec to_xml();toExec to_json();. For more information, see the NXLog documentation about the om_tcp module.define ROOT C:\Program Files\nxlog define WINDNS_OUTPUT_DESTINATION_ADDRESS <hostname> define WINDNS_OUTPUT_DESTINATION_PORT <port> Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension syslog> Module xm_syslog </Extension> # To collect XML logs, use the below NXLog module <Extension xml> Module xm_xml </Extension> # To collect JSON logs, use the below NXLog module <Extension json> Module xm_json </Extension> <Input eventlog> Module im_etw Provider Microsoft-Windows-DNSServer </Input> <Input auditeventlog> Module im_msvistalog <QueryXML> <QueryList> <Query Id="0" Path="Microsoft-Windows-DNSServer/Audit"> <Select Path="Microsoft-Windows-DNSServer/Audit">*</Select> </Query> </QueryList> </QueryXML> </Input> <Output out_chronicle_windns> Module om_tcp Host %WINDNS_OUTPUT_DESTINATION_ADDRESS% Port %WINDNS_OUTPUT_DESTINATION_PORT% Exec $EventTime = integer($EventTime) / 1000; Exec $EventReceivedTime = integer($EventReceivedTime) / 1000; Exec to_xml(); # To collect JSON, use to_json() </Output> <Route analytical_windns_to_chronicle> Path eventlog => out_chronicle_windns </Route> <Route audit_windns_to_chronicle> Path auditeventlog => out_chronicle_windns </Route>Install the Chronicle forwarder on the central Microsoft Windows or Linux server. See the Installing and configuring the forwarder on Linux or Installing and configuring the forwarder on Microsoft Windows for information about installing and configuring the forwarder.
Configure the Chronicle forwarder to send logs to Chronicle. Here is an example forwarder configuration.
- syslog: common: enabled: true data_type: WINDOWS_DNS batch_n_seconds: 10 batch_n_bytes: 1048576 tcp_address: 0.0.0.0:10518 connection_timeout_sec: 60
Field mapping reference: device log fields to UDM fields
This section describes how the parser maps original device log fields to Unified Data Model (UDM) fields.
Common fields
| NXLog field | UDM field | Comment |
|---|---|---|
| SourceName | metadata.vendor_name = "Microsoft" metadata.product_name = "Windows DNS Server" |
|
| EventID | security_result.rule_name | Stored as "EventID: %{EventID}". In events with Error and Warning level, the field is_alert is set to true. |
| Severity | security_result.severity | The values are mapped to the UDM field enum as follows: 0 (None) - UNKNOWN_SEVERITY 1 (Critical) - INFORMATIONAL 2 (Error) - ERROR 3 (Warning) - ERROR 4 (Informational) - INFORMATIONAL 5 (Verbose) - INFORMATIONAL |
| EventTime | metadata.event_timestamp | |
| ExecutionProcessID | principal.process.pid / target.process.pid | Value stored in target.process.pid for the following Event IDs 256, 259,
261, 263, 266, 268, 270, 272, 273, 275, 278, 279, 280. Value stored in principal.process.pid for all other Event IDs. |
| Channel | metadata.product_event_type | |
| Hostname | principal.hostname / target.hostname | Value stored in target.hostname for the following Event IDs: 256, 259, 261,
263, 266, 268, 270, 272, 273, 275, 278, 279, 280. Value stored in principal.hostname from all other Event IDs. |
| UserID | principal.user.windows_sid / target.user.windows_sid | Stored in target.user.windows_sid for the following Event IDs: 256, 259,
261, 263, 266, 268, 270, 272,273, 275, 278, 279, 280. Stored in principal.user.windows_sid for all other Event IDs |
Analytic logs
| Original log field | UDM field | Comment |
|---|---|---|
| AA | network.dns.authoritative | |
| Destination | target.ip / principal.ip | Populated in either principal and target. |
| InterfaceIP | target.ip / principal.ip | Stores DNS Server's IP address in target.ip for following Event IDs, 256,
259, 261, 263, 266, 268, 270, 272, 273, 275, 278, 279, 280. Stored in principal.ip for all other Event IDs (DNS response). |
| PacketData | network.dns.answers.binary_data | |
| Port | target.port / principal.port | |
| QNAME | network.dns.questions.name | |
| QTYPE | network.dns.questions.type | |
| RCODE | network.dns.response_code | |
| RD | network.dns.recursion_desired | |
| Reason | security_result.summary | |
| Source | principal.ip / target.ip | Source IPv4/IPv6 address of the machine that initiated the DNS request. Stored in target.ip for Event ID 274. Stored in target.ip for Event ID 265 and 269, . InterfaceIP contains the secondary server's IP address (principal) and Source (target) is the primary server's IP address. |
| TCP | network.ip_protocol | |
| XID | network.dns.id |
Audit logs
| Original log field | UDM field | Note |
|---|---|---|
| Name | target.resource.name | Value is collected from events with Event ID 512. |
| Policy | target.resource.name | Value is collected from events with Event ID 577, 578, 579, 580, 581, and 582, which are mapped to the SETTING_* event types. |
| QNAME | network.dns.questions.name | |
| QTYPE | network.dns.questions.type | |
| RecursionScope | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
| Scope | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
| Setting | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
| Source | principal.ip | |
| Zone | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
| ZoneScope | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
Field mapping reference: Event ID to UDM event type
This section describes how the parser maps Event Ids to UDM event_types. In general, events are mapped to the NETWORK_DNS metadata.event_type, except for Event IDs in the following section.
| Event Id | Event Text | UDM Event Type | Notes |
|---|---|---|---|
| 275 | XFR_NOTIFY_ACK_IN: Source=%1; InterfaceIP=%2; PacketData=%4 | GENERIC_EVENT | |
| 276 | IXFR_RESP_OUT: TCP=%1; InterfaceIP=%2; Destination=%3; QNAME=%4; XID=%5; ZoneScope=%6; Zone=%7; RCODE=%8; PacketData=%10 | GENERIC_EVENT | |
| 512 | SETTING_CREATION | ||
| 513 | The zone %1 was deleted. | SETTING_DELETION | |
| 514 | The zone %1 was updated. The %2 setting has been set to %3. | SETTING_MODIFICATION | |
| 515 | A resource record of type %1, name %2, TTL %3 and RDATA %5 was created in scope %7 of zone %6. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 516 | A resource record of type %1, name %2 and RDATA %5 was deleted from scope %7 of zone %6. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 517 | All resource records of type %1, name %2 were deleted from scope %4 of zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 518 | All resource records at Node name %1 were deleted from scope %3 of zone %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 519 | A resource record of type %1, name %2, TTL %3 and RDATA %5 was created in scope %7 of zone %6 via dynamic update from IP Address %8. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 520 | A resource record of type %1, name %2 and RDATA %5 was deleted from scope %7 of zone %6 via dynamic update from IP Address %8. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 521 | A resource record of type %1, name %2, TTL %3 and RDATA %5 was scavenged from scope %7 of zone %6. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 522 | The scope %1 was created in zone %2. | SETTING_CREATION | |
| 523 | The scope %1 was deleted in zone %2. | SETTING_DELETION | |
| 525 | The zone %1 was signed with following properties: DenialOfExistence=%2; DistributeTrustAnchor=%3; DnsKeyRecordSetTtl=%4; DSRecordGenerationAlgorithm=%5; DSRecordSetTtl=%6; EnableRfc5011KeyRollover=%7; IsKeyMasterServer=%8; KeyMasterServer=%9; NSec3HashAlgorithm=%10; NSec3Iterations=%11; NSec3OptOut=%12; NSec3RandomSaltLength=%13; NSec3UserSalt=%14; ParentHasSecureDelegation=%15; PropagationTime=%16; SecureDelegationPollingPeriod=%17; SignatureInceptionOffset=%18. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 526 | The zone %1 was unsigned. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 527 | The zone %1 was re-signed with following properties: DenialOfExistence=%2; DistributeTrustAnchor=%3; DnsKeyRecordSetTtl=%4; DSRecordGenerationAlgorithm=%5; DSRecordSetTtl=%6; EnableRfc5011KeyRollover=%7; IsKeyMasterServer=%8; KeyMasterServer=%9; NSec3HashAlgorithm=%10; NSec3Iterations=%11; NSec3OptOut=%12; NSec3RandomSaltLength=%13; NSec3UserSalt=%14; ParentHasSecureDelegation=%15; PropagationTime=%16; SecureDelegationPollingPeriod=%17; SignatureInceptionOffset=%18. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 528 | Rollover was started on the type %1 with GUID %2 of zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 529 | Rollover was completed on the type %1 with GUID %2 of zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 530 | The type %1 with GUID %2 of zone %3 was marked for retiral. The key will be removed after the rollover completion. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 531 | Manual rollover was triggered on the type %1 with GUID %2 of zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 533 | The keys signing key with GUID %1 on zone %2 that was waiting for a Delegation Signer(DS) update on the parent has been forced to move to rollover completion. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 534 | DNSSEC setting metadata was exported %1 key signing key metadata from zone %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 535 | DNSSEC setting metadata was imported on zone %1. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 536 | A record of type %1, QNAME %2 was purged from scope %3 in cache. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 537 | The forwarder list on scope %2 has been reset to %1. | SETTING_MODIFICATION | target.resource.name is set to "Forwarder list on scope: %{scope_name}" |
| 540 | The root hints have been modified. | SETTING_MODIFICATION | target.resource.name populated with text "Root hints" |
| 541 | The setting %1 on scope %2 has been set to %3. | SETTING_MODIFICATION | |
| 542 | The scope %1 of DNS server was created. | SETTING_CREATION | |
| 543 | The scope %1 of DNS server was deleted. | SETTING_DELETION | |
| 544 | The DNSKEY with Key Protocol %2, Base64 Data %4 and Crypto Algorithm %5 has been added at the trust point %1. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 545 | The DS with Key Tag: %2, Digest Type: %3, Digest: %5 and Crypto Algorithm: %6 has been added at the trust point %1. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 546 | The trust point at %1 of type %2 has been removed. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 547 | The trust anchor for the root zone has been added. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 548 | A request to restart the DNS server service has been received. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 549 | The debug logs have been cleared from %1 on DNS server. | SYSTEM_AUDIT_LOG_WIPE | |
| 550 | The in-memory contents of all the zones on DNS server have been flushed to their respective files. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 551 | All the statistical data for the DNS server has been cleared. | SYSTEM_AUDIT_LOG_WIPE | |
| 552 | A resource record scavenging cycle has been started on the DNS Server. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 553 | %1 | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 554 | The resource record scavenging cycle has been terminated on the DNS Server. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 555 | The DNS server has been prepared for demotion by removing references to it from all zones stored in the Active Directory. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 556 | The information about the root hints on the DNS server has been written back to the persistent storage. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 557 | The addresses on which DNS server will listen has been changed to %1. | SETTING_MODIFICATION | target.resource.name populated with text "Listen Addresses" |
| 558 | An immediate RFC 5011 active refresh has been scheduled for all trust points. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 559 | The zone %1 is paused. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 560 | The zone %1 is resumed. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 561 | The data for zone %1 has been reloaded from %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 562 | The data for zone %1 has been refreshed from the master server %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 563 | The secondary zone %1 has been expired and new data has been requested from the master server %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 564 | The zone %1 has been reloaded from the Active Directory. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 565 | The content of the zone %1 has been written to the disk and the notification has been sent to all the notify servers. | SETTING_MODIFICATION | |
| 566 | All DNS records at the node %1 in the zone %2 will have their aging time stamp set to the current time.%3 | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 567 | The Active Directory-integrated zone %1 has been updated. Only %2 can run scavenging. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 568 | The key master role for zone %1 has been %2.%3 | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 569 | A %1 singing key (%2) descriptor has been added on the zone %3 with following properties: KeyId=%4; KeyType=%5; CurrentState=%6; KeyStorageProvider=%7; StoreKeysInAD=%8; CryptoAlgorithm=%9; KeyLength=%10; DnsKeySignatureValidityPeriod=%11; DSSignatureValidityPeriod=%12; ZoneSignatureValidityPeriod=%13; InitialRolloverOffset=%14; RolloverPeriod=%15; RolloverType=%16; NextRolloverAction=%17; LastRolloverTime=%18; NextRolloverTime=%19; CurrentRolloverStatus=%20; ActiveKey=%21; StandbyKey=%22; NextKey=%23. The zone will be resigned with the %2 generated with these properties. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 570 | A %1 singing key (%2) descriptor with GUID %3 has been updated on the zone %4. The properties of this %2 descriptor have been set to: KeyId=%5; KeyType=%6; CurrentState=%7; KeyStorageProvider=%8; StoreKeysInAD=%9; CryptoAlgorithm=%10; KeyLength=%11; DnsKeySignatureValidityPeriod=%12; DSSignatureValidityPeriod=%13; ZoneSignatureValidityPeriod=%14; InitialRolloverOffset=%15; RolloverPeriod=%16; RolloverType=%17; NextRolloverAction=%18; LastRolloverTime=%19; NextRolloverTime=%20; CurrentRolloverStatus=%21; ActiveKey=%22; StandbyKey=%23; NextKey=%24. The zone will be resigned with the %2 generated with these properties. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 571 | A %1 singing key (%2) descriptor %4 has been removed from the zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 572 | The state of the %1 signing key (%2) %3 has been modified on zone %4. The new active key is %5, standby key is %6 and next key is %7. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 573 | A delegation for %1 in the scope %2 of zone %3 with the name server %4 has been added. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 574 | The client subnet record with name %1 value %2 has been added to the client subnet map. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 575 | The client subnet record with name %1 has been deleted from the client subnet map. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 576 | The client subnet record with name %1 has been updated from the client subnet map. The new client subnets that it refers to are %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 577 | A server level policy %6 for %1 has been created on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5. | SETTING_CREATION | |
| 578 | A zone level policy %8 for %1 has been created on zone %6 on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5; Scopes:%7. | SETTING_CREATION | |
| 579 | A forwarding policy %6 has been created on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5; Scope:%1. | SETTING_CREATION | |
| 580 | The server level policy %1 has been deleted from server %2. | SETTING_DELETION | |
| 581 | The zone level policy %1 has been deleted from zone %3 on server %2. | SETTING_DELETION | |
| 582 | The forwarding policy %1 has been deleted from server %2. | SETTING_DELETION |