Mantieni tutto organizzato con le raccolte Salva e classifica i contenuti in base alle tue preferenze.

Raccogliere i dati DNS di Microsoft Windows

Questo documento:

  • Descrive l'architettura di deployment e i passaggi di installazione, oltre a eventuali configurazioni richieste che generano log supportati dagli eventi DNS di Chronicle per Microsoft Windows. Per una panoramica dell'importazione dei dati di Chronicle, vedi Importazione di dati in Chronicle.
  • Include informazioni su come l'analizzatore sintattico mappa i campi nel log originale nei campi Chronicle Unified Data Model.

Le informazioni contenute in questo documento si applicano all'analizzatore sintattico con l'etichetta di importazione WINDOWS_DNS. L'etichetta di importazione identifica quale analizzatore sintattico normalizza i dati di log non elaborati in formato UDM strutturato.

Prima di iniziare

  • Esamina l'architettura di deployment consigliata.

    Il seguente diagramma illustra i componenti principali consigliati in un'architettura di deployment per raccogliere e inviare eventi DNS di Microsoft Windows a Chronicle. Confronta queste informazioni con il tuo ambiente per assicurarti che questi componenti siano installati. Ogni deployment dei clienti sarà diverso da questa rappresentazione e potrebbe essere più complessa. È obbligatorio:

    • Server DNS Microsoft Windows con la registrazione diagnostica DNS attiva.
    • Tutti i sistemi configurati con il fuso orario UTC.
    • NXLog installato su server Microsoft Windows in cluster per raccogliere e inoltrare i log al server Microsoft Windows o Linux centrale.
    • Inoltro Chronicle installato sul server Microsoft Windows o Linux centrale.

    Architettura di deployment

  • Esamina le versioni e i dispositivi supportati.

    L'analizzatore sintattico Chronicle supporta i log delle seguenti versioni di Microsoft Windows Server. Microsoft Windows Server è disponibile con le seguenti versioni: Foundation, Essentials, Standard e Datacenter. Lo schema di eventi dei log generati da ogni edizione non cambia.

    • Microsoft Windows Server 2019
    • Microsoft Windows Server 2016
    • Microsoft Windows Server 2012 R2

    L'analizzatore sintattico Chronicle supporta i log raccolti da NXLog Enterprise Edition.

  • Esamina i tipi di log supportati. L'analizzatore sintattico Chronicle supporta i seguenti tipi di log generati dai server DNS Microsoft Windows. Per ulteriori informazioni su questi tipi di log, consulta la documentazione di Logging e diagnostica DNS di Microsoft Windows. Supporta i log generati con testo in lingua inglese e non è supportato per quelli generati in lingue diverse dall'inglese.

    • Audit log: per una descrizione di questo tipo di log, consulta la documentazione degli audit log di Microsoft Windows.
    • Log di Analytics: per una descrizione di questo tipo di log, consulta la documentazione dei log di Analytics di Microsoft Windows.

  • Configurare i server DNS Microsoft Windows. Per informazioni sull'installazione e l'attivazione del logging diagnostico DNS, consulta la documentazione di Microsoft Windows.

  • Installare e configurare il server Windows o Linux centrale.

  • Configura tutti i sistemi che hanno il fuso orario UTC.

Configura l'inoltro NXLog e Chronicle

  1. Installa NXLog su ciascun server DNS di Microsoft Windows. Segui la documentazione di NXLog.

  2. Crea un file di configurazione per ogni istanza NXLog. Utilizza il modulo di input im_etw per estrarre i log di analisi DNS e il modulo di input im_msvistalog per gli audit log.

    Ecco un esempio di configurazione NXLog. Sostituisci i valori <hostname> e <port> con le informazioni sul server Microsoft Windows o Linux centrale. Per convertire e analizzare facoltativamente i log in formato JSON, anziché XML, modifica la riga Exec to_xml(); in Exec to_json();. Per ulteriori informazioni, consulta la documentazione di NXLog sul modulo om_tcp.

    define ROOT C:\Program Files\nxlog
define WINDNS_OUTPUT_DESTINATION_ADDRESS <hostname>
define WINDNS_OUTPUT_DESTINATION_PORT <port>

Moduledir   %ROOT%\modules
CacheDir    %ROOT%\data
Pidfile     %ROOT%\data\nxlog.pid
SpoolDir    %ROOT%\data
LogFile     %ROOT%\data\nxlog.log

<Extension syslog>
    Module      xm_syslog
</Extension>

# To collect XML logs, use the below NXLog module
<Extension xml>
    Module      xm_xml
</Extension>

# To collect JSON logs, use the below NXLog module
<Extension json>
    Module      xm_json
</Extension>

<Input eventlog>
    Module      im_etw
    Provider    Microsoft-Windows-DNSServer
</Input>

<Input auditeventlog>
    Module      im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id="0" Path="Microsoft-Windows-DNSServer/Audit">
                <Select Path="Microsoft-Windows-DNSServer/Audit">*</Select>
            </Query>
        </QueryList>
    </QueryXML>
</Input>

<Output out_chronicle_windns>
    Module      om_tcp
    Host        %WINDNS_OUTPUT_DESTINATION_ADDRESS%
    Port        %WINDNS_OUTPUT_DESTINATION_PORT%
    Exec        $EventTime = integer($EventTime) / 1000;
    Exec        $EventReceivedTime = integer($EventReceivedTime) / 1000;
    Exec        to_xml(); # To collect JSON, use to_json()
</Output>

<Route analytical_windns_to_chronicle>
    Path    eventlog => out_chronicle_windns
</Route>

<Route audit_windns_to_chronicle>
    Path    auditeventlog => out_chronicle_windns
</Route>

  3. Installa lo strumento per l'inoltro di Chronicle sul server centrale Microsoft Windows o Linux. Per informazioni sull'installazione e sulla configurazione dello strumento di forwarding, consulta Installare e configurare lo strumento di forwarding su Linux o Installare e configurare lo strumento di forwarding su Microsoft Windows.

  4. Configura lo strumento per l'inoltro di Chronicle per inviare i log a Chronicle. Ecco un esempio di configurazione dello strumento per l'inoltro.

      - syslog:
      common:
        enabled: true
        data_type: WINDOWS_DNS
        batch_n_seconds: 10
        batch_n_bytes: 1048576
      tcp_address: 0.0.0.0:10518
      connection_timeout_sec: 60

Riferimento per la mappatura dei campi: campi del log dispositivo ai campi UDM

Questa sezione descrive il modo in cui l'analizzatore sintattico mappa i campi di log dispositivo originali ai campi UDM (Unified Data Model).

Campi comuni

Campo NXLog Campo UDM Commento
SourceName metadata.vendor_name = "Microsoft"

metadata.product_name = "Windows DNS Server"
EventID security_result.rule_name Stored as "EventID: %{EventID}". In events with Error and Warning level, the field is_alert is set to true.
Severity security_result.severity The values are mapped to the UDM field enum as follows:
0 (None) - UNKNOWN_SEVERITY
1 (Critical) - INFORMATIONAL
2 (Error) - ERROR
3 (Warning) - ERROR
4 (Informational) - INFORMATIONAL
5 (Verbose) - INFORMATIONAL
EventTime metadata.event_timestamp
ExecutionProcessID principal.process.pid / target.process.pid Value stored in target.process.pid for the following Event IDs 256, 259, 261, 263, 266, 268, 270, 272, 273, 275, 278, 279, 280.
Value stored in principal.process.pid for all other Event IDs.
Channel metadata.product_event_type
Hostname principal.hostname / target.hostname Value stored in target.hostname for the following Event IDs: 256, 259, 261, 263, 266, 268, 270, 272, 273, 275, 278, 279, 280.

Value stored in principal.hostname from all other Event IDs.
UserID principal.user.windows_sid / target.user.windows_sid Stored in target.user.windows_sid for the following Event IDs: 256, 259, 261, 263, 266, 268, 270, 272,273, 275, 278, 279, 280.

Stored in principal.user.windows_sid for all other Event IDs

Log di analisi

Campo del log originale Campo UDM Commento
AA network.dns.authoritative
Destination target.ip / principal.ip Populated in either principal and target.
InterfaceIP target.ip / principal.ip Stores DNS Server's IP address in target.ip for following Event IDs, 256, 259, 261, 263, 266, 268, 270, 272, 273, 275, 278, 279, 280.
Stored in principal.ip for all other Event IDs (DNS response).
PacketData network.dns.answers.binary_data
Port target.port / principal.port
QNAME network.dns.questions.name
QTYPE network.dns.questions.type
RCODE network.dns.response_code
RD network.dns.recursion_desired
Reason security_result.summary
Source principal.ip / target.ip Source IPv4/IPv6 address of the machine that initiated the DNS request.
Stored in target.ip for Event ID 274. Stored in target.ip for Event ID 265 and 269, . InterfaceIP contains the secondary server's IP address (principal) and Source (target) is the primary server's IP address.
TCP network.ip_protocol
XID network.dns.id

Audit log

Campo del log originale Campo UDM Nota
Name target.resource.name Value is collected from events with Event ID 512.
Policy target.resource.name Value is collected from events with Event ID 577, 578, 579, 580, 581, and 582, which are mapped to the SETTING_* event types.
QNAME network.dns.questions.name
QTYPE network.dns.questions.type
RecursionScope target.resource.name Value is collected from events with Event IDs mapped to SETTING_* event types.
Scope target.resource.name Value is collected from events with Event IDs mapped to SETTING_* event types.
Setting target.resource.name Value is collected from events with Event IDs mapped to SETTING_* event types.
Source principal.ip
Zone target.resource.name Value is collected from events with Event IDs mapped to SETTING_* event types.
ZoneScope target.resource.name Value is collected from events with Event IDs mapped to SETTING_* event types.

Riferimento per la mappatura dei campi: ID evento nel tipo di evento UDM

In questa sezione viene descritto in che modo l'analizzatore sintattico associa gli ID evento a UDM event_types. In generale, gli eventi vengono mappati a NETWORK_DNS metadata.event_type, ad eccezione degli ID evento nella sezione seguente.

ID evento Testo dell'evento Tipo di evento UDM Note
275 XFR_NOTIFY_ACK_IN: Source=%1; InterfaceIP=%2; PacketData=%4 GENERIC_EVENT
276 IXFR_RESP_OUT: TCP=%1; InterfaceIP=%2; Destination=%3; QNAME=%4; XID=%5; ZoneScope=%6; Zone=%7; RCODE=%8; PacketData=%10 GENERIC_EVENT
512 SETTING_CREATION
513 The zone %1 was deleted. SETTING_DELETION
514 The zone %1 was updated. The %2 setting has been set to %3. SETTING_MODIFICATION
515 A resource record of type %1, name %2, TTL %3 and RDATA %5 was created in scope %7 of zone %6. SYSTEM_AUDIT_LOG_UNCATEGORIZED
516 A resource record of type %1, name %2 and RDATA %5 was deleted from scope %7 of zone %6. SYSTEM_AUDIT_LOG_UNCATEGORIZED
517 All resource records of type %1, name %2 were deleted from scope %4 of zone %3. SYSTEM_AUDIT_LOG_UNCATEGORIZED
518 All resource records at Node name %1 were deleted from scope %3 of zone %2. SYSTEM_AUDIT_LOG_UNCATEGORIZED
519 A resource record of type %1, name %2, TTL %3 and RDATA %5 was created in scope %7 of zone %6 via dynamic update from IP Address %8. SYSTEM_AUDIT_LOG_UNCATEGORIZED
520 A resource record of type %1, name %2 and RDATA %5 was deleted from scope %7 of zone %6 via dynamic update from IP Address %8. SYSTEM_AUDIT_LOG_UNCATEGORIZED
521 A resource record of type %1, name %2, TTL %3 and RDATA %5 was scavenged from scope %7 of zone %6. SYSTEM_AUDIT_LOG_UNCATEGORIZED
522 The scope %1 was created in zone %2. SETTING_CREATION
523 The scope %1 was deleted in zone %2. SETTING_DELETION
525 The zone %1 was signed with following properties: DenialOfExistence=%2; DistributeTrustAnchor=%3; DnsKeyRecordSetTtl=%4; DSRecordGenerationAlgorithm=%5; DSRecordSetTtl=%6; EnableRfc5011KeyRollover=%7; IsKeyMasterServer=%8; KeyMasterServer=%9; NSec3HashAlgorithm=%10; NSec3Iterations=%11; NSec3OptOut=%12; NSec3RandomSaltLength=%13; NSec3UserSalt=%14; ParentHasSecureDelegation=%15; PropagationTime=%16; SecureDelegationPollingPeriod=%17; SignatureInceptionOffset=%18. SYSTEM_AUDIT_LOG_UNCATEGORIZED
526 The zone %1 was unsigned. SYSTEM_AUDIT_LOG_UNCATEGORIZED
527 The zone %1 was re-signed with following properties: DenialOfExistence=%2; DistributeTrustAnchor=%3; DnsKeyRecordSetTtl=%4; DSRecordGenerationAlgorithm=%5; DSRecordSetTtl=%6; EnableRfc5011KeyRollover=%7; IsKeyMasterServer=%8; KeyMasterServer=%9; NSec3HashAlgorithm=%10; NSec3Iterations=%11; NSec3OptOut=%12; NSec3RandomSaltLength=%13; NSec3UserSalt=%14; ParentHasSecureDelegation=%15; PropagationTime=%16; SecureDelegationPollingPeriod=%17; SignatureInceptionOffset=%18. SYSTEM_AUDIT_LOG_UNCATEGORIZED
528 Rollover was started on the type %1 with GUID %2 of zone %3. SYSTEM_AUDIT_LOG_UNCATEGORIZED
529 Rollover was completed on the type %1 with GUID %2 of zone %3. SYSTEM_AUDIT_LOG_UNCATEGORIZED
530 The type %1 with GUID %2 of zone %3 was marked for retiral. The key will be removed after the rollover completion. SYSTEM_AUDIT_LOG_UNCATEGORIZED
531 Manual rollover was triggered on the type %1 with GUID %2 of zone %3. SYSTEM_AUDIT_LOG_UNCATEGORIZED
533 The keys signing key with GUID %1 on zone %2 that was waiting for a Delegation Signer(DS) update on the parent has been forced to move to rollover completion. SYSTEM_AUDIT_LOG_UNCATEGORIZED
534 DNSSEC setting metadata was exported %1 key signing key metadata from zone %2. SYSTEM_AUDIT_LOG_UNCATEGORIZED
535 DNSSEC setting metadata was imported on zone %1. SYSTEM_AUDIT_LOG_UNCATEGORIZED
536 A record of type %1, QNAME %2 was purged from scope %3 in cache. SYSTEM_AUDIT_LOG_UNCATEGORIZED
537 The forwarder list on scope %2 has been reset to %1. SETTING_MODIFICATION target.resource.name is set to "Forwarder list on scope: %{scope_name}"
540 The root hints have been modified. SETTING_MODIFICATION target.resource.name populated with text "Root hints"
541 The setting %1 on scope %2 has been set to %3. SETTING_MODIFICATION
542 The scope %1 of DNS server was created. SETTING_CREATION
543 The scope %1 of DNS server was deleted. SETTING_DELETION
544 The DNSKEY with Key Protocol %2, Base64 Data %4 and Crypto Algorithm %5 has been added at the trust point %1. SYSTEM_AUDIT_LOG_UNCATEGORIZED
545 The DS with Key Tag: %2, Digest Type: %3, Digest: %5 and Crypto Algorithm: %6 has been added at the trust point %1. SYSTEM_AUDIT_LOG_UNCATEGORIZED
546 The trust point at %1 of type %2 has been removed. SYSTEM_AUDIT_LOG_UNCATEGORIZED
547 The trust anchor for the root zone has been added. SYSTEM_AUDIT_LOG_UNCATEGORIZED
548 A request to restart the DNS server service has been received. SYSTEM_AUDIT_LOG_UNCATEGORIZED
549 The debug logs have been cleared from %1 on DNS server. SYSTEM_AUDIT_LOG_WIPE
550 The in-memory contents of all the zones on DNS server have been flushed to their respective files. SYSTEM_AUDIT_LOG_UNCATEGORIZED
551 All the statistical data for the DNS server has been cleared. SYSTEM_AUDIT_LOG_WIPE
552 A resource record scavenging cycle has been started on the DNS Server. SYSTEM_AUDIT_LOG_UNCATEGORIZED
553 %1 SYSTEM_AUDIT_LOG_UNCATEGORIZED
554 The resource record scavenging cycle has been terminated on the DNS Server. SYSTEM_AUDIT_LOG_UNCATEGORIZED
555 The DNS server has been prepared for demotion by removing references to it from all zones stored in the Active Directory. SYSTEM_AUDIT_LOG_UNCATEGORIZED
556 The information about the root hints on the DNS server has been written back to the persistent storage. SYSTEM_AUDIT_LOG_UNCATEGORIZED
557 The addresses on which DNS server will listen has been changed to %1. SETTING_MODIFICATION target.resource.name populated with text "Listen Addresses"
558 An immediate RFC 5011 active refresh has been scheduled for all trust points. SYSTEM_AUDIT_LOG_UNCATEGORIZED
559 The zone %1 is paused. SYSTEM_AUDIT_LOG_UNCATEGORIZED
560 The zone %1 is resumed. SYSTEM_AUDIT_LOG_UNCATEGORIZED
561 The data for zone %1 has been reloaded from %2. SYSTEM_AUDIT_LOG_UNCATEGORIZED
562 The data for zone %1 has been refreshed from the master server %2. SYSTEM_AUDIT_LOG_UNCATEGORIZED
563 The secondary zone %1 has been expired and new data has been requested from the master server %2. SYSTEM_AUDIT_LOG_UNCATEGORIZED
564 The zone %1 has been reloaded from the Active Directory. SYSTEM_AUDIT_LOG_UNCATEGORIZED
565 The content of the zone %1 has been written to the disk and the notification has been sent to all the notify servers. SETTING_MODIFICATION
566 All DNS records at the node %1 in the zone %2 will have their aging time stamp set to the current time.%3 SYSTEM_AUDIT_LOG_UNCATEGORIZED
567 The Active Directory-integrated zone %1 has been updated. Only %2 can run scavenging. SYSTEM_AUDIT_LOG_UNCATEGORIZED
568 The key master role for zone %1 has been %2.%3 SYSTEM_AUDIT_LOG_UNCATEGORIZED
569 A %1 singing key (%2) descriptor has been added on the zone %3 with following properties: KeyId=%4; KeyType=%5; CurrentState=%6; KeyStorageProvider=%7; StoreKeysInAD=%8; CryptoAlgorithm=%9; KeyLength=%10; DnsKeySignatureValidityPeriod=%11; DSSignatureValidityPeriod=%12; ZoneSignatureValidityPeriod=%13; InitialRolloverOffset=%14; RolloverPeriod=%15; RolloverType=%16; NextRolloverAction=%17; LastRolloverTime=%18; NextRolloverTime=%19; CurrentRolloverStatus=%20; ActiveKey=%21; StandbyKey=%22; NextKey=%23. The zone will be resigned with the %2 generated with these properties. SYSTEM_AUDIT_LOG_UNCATEGORIZED
570 A %1 singing key (%2) descriptor with GUID %3 has been updated on the zone %4. The properties of this %2 descriptor have been set to: KeyId=%5; KeyType=%6; CurrentState=%7; KeyStorageProvider=%8; StoreKeysInAD=%9; CryptoAlgorithm=%10; KeyLength=%11; DnsKeySignatureValidityPeriod=%12; DSSignatureValidityPeriod=%13; ZoneSignatureValidityPeriod=%14; InitialRolloverOffset=%15; RolloverPeriod=%16; RolloverType=%17; NextRolloverAction=%18; LastRolloverTime=%19; NextRolloverTime=%20; CurrentRolloverStatus=%21; ActiveKey=%22; StandbyKey=%23; NextKey=%24. The zone will be resigned with the %2 generated with these properties. SYSTEM_AUDIT_LOG_UNCATEGORIZED
571 A %1 singing key (%2) descriptor %4 has been removed from the zone %3. SYSTEM_AUDIT_LOG_UNCATEGORIZED
572 The state of the %1 signing key (%2) %3 has been modified on zone %4. The new active key is %5, standby key is %6 and next key is %7. SYSTEM_AUDIT_LOG_UNCATEGORIZED
573 A delegation for %1 in the scope %2 of zone %3 with the name server %4 has been added. SYSTEM_AUDIT_LOG_UNCATEGORIZED
574 The client subnet record with name %1 value %2 has been added to the client subnet map. SYSTEM_AUDIT_LOG_UNCATEGORIZED
575 The client subnet record with name %1 has been deleted from the client subnet map. SYSTEM_AUDIT_LOG_UNCATEGORIZED
576 The client subnet record with name %1 has been updated from the client subnet map. The new client subnets that it refers to are %2. SYSTEM_AUDIT_LOG_UNCATEGORIZED
577 A server level policy %6 for %1 has been created on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5. SETTING_CREATION
578 A zone level policy %8 for %1 has been created on zone %6 on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5; Scopes:%7. SETTING_CREATION
579 A forwarding policy %6 has been created on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5; Scope:%1. SETTING_CREATION
580 The server level policy %1 has been deleted from server %2. SETTING_DELETION
581 The zone level policy %1 has been deleted from zone %3 on server %2. SETTING_DELETION
582 The forwarding policy %1 has been deleted from server %2. SETTING_DELETION