Raccogliere i dati DNS di Microsoft Windows
Questo documento:
- Descrive l'architettura di deployment e i passaggi di installazione, oltre a eventuali configurazioni richieste che generano log supportati dagli eventi DNS di Chronicle per Microsoft Windows. Per una panoramica dell'importazione dei dati di Chronicle, vedi Importazione di dati in Chronicle.
- Include informazioni su come l'analizzatore sintattico mappa i campi nel log originale nei campi Chronicle Unified Data Model.
Le informazioni contenute in questo documento si applicano all'analizzatore sintattico con l'etichetta di importazione WINDOWS_DNS. L'etichetta di importazione identifica quale analizzatore sintattico normalizza i dati di log non elaborati in formato UDM strutturato.
Prima di iniziare
Esamina l'architettura di deployment consigliata.
Il seguente diagramma illustra i componenti principali consigliati in un'architettura di deployment per raccogliere e inviare eventi DNS di Microsoft Windows a Chronicle. Confronta queste informazioni con il tuo ambiente per assicurarti che questi componenti siano installati. Ogni deployment dei clienti sarà diverso da questa rappresentazione e potrebbe essere più complessa. È obbligatorio:
- Server DNS Microsoft Windows con la registrazione diagnostica DNS attiva.
- Tutti i sistemi configurati con il fuso orario UTC.
- NXLog installato su server Microsoft Windows in cluster per raccogliere e inoltrare i log al server Microsoft Windows o Linux centrale.
- Inoltro Chronicle installato sul server Microsoft Windows o Linux centrale.
Esamina le versioni e i dispositivi supportati.
L'analizzatore sintattico Chronicle supporta i log delle seguenti versioni di Microsoft Windows Server. Microsoft Windows Server è disponibile con le seguenti versioni: Foundation, Essentials, Standard e Datacenter. Lo schema di eventi dei log generati da ogni edizione non cambia.
- Microsoft Windows Server 2019
- Microsoft Windows Server 2016
- Microsoft Windows Server 2012 R2
L'analizzatore sintattico Chronicle supporta i log raccolti da NXLog Enterprise Edition.
Esamina i tipi di log supportati. L'analizzatore sintattico Chronicle supporta i seguenti tipi di log generati dai server DNS Microsoft Windows. Per ulteriori informazioni su questi tipi di log, consulta la documentazione di Logging e diagnostica DNS di Microsoft Windows. Supporta i log generati con testo in lingua inglese e non è supportato per quelli generati in lingue diverse dall'inglese.
- Audit log: per una descrizione di questo tipo di log, consulta la documentazione degli audit log di Microsoft Windows.
- Log di Analytics: per una descrizione di questo tipo di log, consulta la documentazione dei log di Analytics di Microsoft Windows.
Configurare i server DNS Microsoft Windows. Per informazioni sull'installazione e l'attivazione del logging diagnostico DNS, consulta la documentazione di Microsoft Windows.
Installare e configurare il server Windows o Linux centrale.
Configura tutti i sistemi che hanno il fuso orario UTC.
Configura l'inoltro NXLog e Chronicle
- Installa NXLog su ciascun server DNS di Microsoft Windows. Segui la documentazione di NXLog.
Crea un file di configurazione per ogni istanza NXLog. Utilizza il modulo di input im_etw per estrarre i log di analisi DNS e il modulo di input im_msvistalog per gli audit log.
- Per ulteriori informazioni sul modulo di input im_etw, consulta la pagina relativa al monitoraggio degli eventi per Microsoft Windows (im_etw), tra cui la configurazione di NXLog per il DNS di Microsoft Windows.
- Per ulteriori informazioni sul modulo di input im_msvistalog, consulta Log eventi per Microsoft Windows 2008/Vista e versioni successive (im_msvistalog).
Ecco un esempio di configurazione NXLog. Sostituisci i valori
<hostname>e<port>con le informazioni sul server Microsoft Windows o Linux centrale. Per convertire e analizzare facoltativamente i log in formato JSON, anziché XML, modifica la rigaExec to_xml();inExec to_json();. Per ulteriori informazioni, consulta la documentazione di NXLog sul modulo om_tcp.define ROOT C:\Program Files\nxlog define WINDNS_OUTPUT_DESTINATION_ADDRESS <hostname> define WINDNS_OUTPUT_DESTINATION_PORT <port> Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension syslog> Module xm_syslog </Extension> # To collect XML logs, use the below NXLog module <Extension xml> Module xm_xml </Extension> # To collect JSON logs, use the below NXLog module <Extension json> Module xm_json </Extension> <Input eventlog> Module im_etw Provider Microsoft-Windows-DNSServer </Input> <Input auditeventlog> Module im_msvistalog <QueryXML> <QueryList> <Query Id="0" Path="Microsoft-Windows-DNSServer/Audit"> <Select Path="Microsoft-Windows-DNSServer/Audit">*</Select> </Query> </QueryList> </QueryXML> </Input> <Output out_chronicle_windns> Module om_tcp Host %WINDNS_OUTPUT_DESTINATION_ADDRESS% Port %WINDNS_OUTPUT_DESTINATION_PORT% Exec $EventTime = integer($EventTime) / 1000; Exec $EventReceivedTime = integer($EventReceivedTime) / 1000; Exec to_xml(); # To collect JSON, use to_json() </Output> <Route analytical_windns_to_chronicle> Path eventlog => out_chronicle_windns </Route> <Route audit_windns_to_chronicle> Path auditeventlog => out_chronicle_windns </Route>Installa lo strumento per l'inoltro di Chronicle sul server centrale Microsoft Windows o Linux. Per informazioni sull'installazione e sulla configurazione dello strumento di forwarding, consulta Installare e configurare lo strumento di forwarding su Linux o Installare e configurare lo strumento di forwarding su Microsoft Windows.
Configura lo strumento per l'inoltro di Chronicle per inviare i log a Chronicle. Ecco un esempio di configurazione dello strumento per l'inoltro.
- syslog: common: enabled: true data_type: WINDOWS_DNS batch_n_seconds: 10 batch_n_bytes: 1048576 tcp_address: 0.0.0.0:10518 connection_timeout_sec: 60
Riferimento per la mappatura dei campi: campi del log dispositivo ai campi UDM
Questa sezione descrive il modo in cui l'analizzatore sintattico mappa i campi di log dispositivo originali ai campi UDM (Unified Data Model).
Campi comuni
| Campo NXLog | Campo UDM | Commento |
|---|---|---|
| SourceName | metadata.vendor_name = "Microsoft" metadata.product_name = "Windows DNS Server" |
|
| EventID | security_result.rule_name | Stored as "EventID: %{EventID}". In events with Error and Warning level, the field is_alert is set to true. |
| Severity | security_result.severity | The values are mapped to the UDM field enum as follows: 0 (None) - UNKNOWN_SEVERITY 1 (Critical) - INFORMATIONAL 2 (Error) - ERROR 3 (Warning) - ERROR 4 (Informational) - INFORMATIONAL 5 (Verbose) - INFORMATIONAL |
| EventTime | metadata.event_timestamp | |
| ExecutionProcessID | principal.process.pid / target.process.pid | Value stored in target.process.pid for the following Event IDs 256, 259,
261, 263, 266, 268, 270, 272, 273, 275, 278, 279, 280. Value stored in principal.process.pid for all other Event IDs. |
| Channel | metadata.product_event_type | |
| Hostname | principal.hostname / target.hostname | Value stored in target.hostname for the following Event IDs: 256, 259, 261,
263, 266, 268, 270, 272, 273, 275, 278, 279, 280. Value stored in principal.hostname from all other Event IDs. |
| UserID | principal.user.windows_sid / target.user.windows_sid | Stored in target.user.windows_sid for the following Event IDs: 256, 259,
261, 263, 266, 268, 270, 272,273, 275, 278, 279, 280. Stored in principal.user.windows_sid for all other Event IDs |
Log di analisi
| Campo del log originale | Campo UDM | Commento |
|---|---|---|
| AA | network.dns.authoritative | |
| Destination | target.ip / principal.ip | Populated in either principal and target. |
| InterfaceIP | target.ip / principal.ip | Stores DNS Server's IP address in target.ip for following Event IDs, 256,
259, 261, 263, 266, 268, 270, 272, 273, 275, 278, 279, 280. Stored in principal.ip for all other Event IDs (DNS response). |
| PacketData | network.dns.answers.binary_data | |
| Port | target.port / principal.port | |
| QNAME | network.dns.questions.name | |
| QTYPE | network.dns.questions.type | |
| RCODE | network.dns.response_code | |
| RD | network.dns.recursion_desired | |
| Reason | security_result.summary | |
| Source | principal.ip / target.ip | Source IPv4/IPv6 address of the machine that initiated the DNS request. Stored in target.ip for Event ID 274. Stored in target.ip for Event ID 265 and 269, . InterfaceIP contains the secondary server's IP address (principal) and Source (target) is the primary server's IP address. |
| TCP | network.ip_protocol | |
| XID | network.dns.id |
Audit log
| Campo del log originale | Campo UDM | Nota |
|---|---|---|
| Name | target.resource.name | Value is collected from events with Event ID 512. |
| Policy | target.resource.name | Value is collected from events with Event ID 577, 578, 579, 580, 581, and 582, which are mapped to the SETTING_* event types. |
| QNAME | network.dns.questions.name | |
| QTYPE | network.dns.questions.type | |
| RecursionScope | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
| Scope | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
| Setting | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
| Source | principal.ip | |
| Zone | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
| ZoneScope | target.resource.name | Value is collected from events with Event IDs mapped to SETTING_* event types. |
Riferimento per la mappatura dei campi: ID evento nel tipo di evento UDM
In questa sezione viene descritto in che modo l'analizzatore sintattico associa gli ID evento a UDM event_types. In generale, gli eventi vengono mappati a NETWORK_DNS metadata.event_type, ad eccezione degli ID evento nella sezione seguente.
| ID evento | Testo dell'evento | Tipo di evento UDM | Note |
|---|---|---|---|
| 275 | XFR_NOTIFY_ACK_IN: Source=%1; InterfaceIP=%2; PacketData=%4 | GENERIC_EVENT | |
| 276 | IXFR_RESP_OUT: TCP=%1; InterfaceIP=%2; Destination=%3; QNAME=%4; XID=%5; ZoneScope=%6; Zone=%7; RCODE=%8; PacketData=%10 | GENERIC_EVENT | |
| 512 | SETTING_CREATION | ||
| 513 | The zone %1 was deleted. | SETTING_DELETION | |
| 514 | The zone %1 was updated. The %2 setting has been set to %3. | SETTING_MODIFICATION | |
| 515 | A resource record of type %1, name %2, TTL %3 and RDATA %5 was created in scope %7 of zone %6. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 516 | A resource record of type %1, name %2 and RDATA %5 was deleted from scope %7 of zone %6. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 517 | All resource records of type %1, name %2 were deleted from scope %4 of zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 518 | All resource records at Node name %1 were deleted from scope %3 of zone %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 519 | A resource record of type %1, name %2, TTL %3 and RDATA %5 was created in scope %7 of zone %6 via dynamic update from IP Address %8. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 520 | A resource record of type %1, name %2 and RDATA %5 was deleted from scope %7 of zone %6 via dynamic update from IP Address %8. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 521 | A resource record of type %1, name %2, TTL %3 and RDATA %5 was scavenged from scope %7 of zone %6. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 522 | The scope %1 was created in zone %2. | SETTING_CREATION | |
| 523 | The scope %1 was deleted in zone %2. | SETTING_DELETION | |
| 525 | The zone %1 was signed with following properties: DenialOfExistence=%2; DistributeTrustAnchor=%3; DnsKeyRecordSetTtl=%4; DSRecordGenerationAlgorithm=%5; DSRecordSetTtl=%6; EnableRfc5011KeyRollover=%7; IsKeyMasterServer=%8; KeyMasterServer=%9; NSec3HashAlgorithm=%10; NSec3Iterations=%11; NSec3OptOut=%12; NSec3RandomSaltLength=%13; NSec3UserSalt=%14; ParentHasSecureDelegation=%15; PropagationTime=%16; SecureDelegationPollingPeriod=%17; SignatureInceptionOffset=%18. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 526 | The zone %1 was unsigned. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 527 | The zone %1 was re-signed with following properties: DenialOfExistence=%2; DistributeTrustAnchor=%3; DnsKeyRecordSetTtl=%4; DSRecordGenerationAlgorithm=%5; DSRecordSetTtl=%6; EnableRfc5011KeyRollover=%7; IsKeyMasterServer=%8; KeyMasterServer=%9; NSec3HashAlgorithm=%10; NSec3Iterations=%11; NSec3OptOut=%12; NSec3RandomSaltLength=%13; NSec3UserSalt=%14; ParentHasSecureDelegation=%15; PropagationTime=%16; SecureDelegationPollingPeriod=%17; SignatureInceptionOffset=%18. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 528 | Rollover was started on the type %1 with GUID %2 of zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 529 | Rollover was completed on the type %1 with GUID %2 of zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 530 | The type %1 with GUID %2 of zone %3 was marked for retiral. The key will be removed after the rollover completion. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 531 | Manual rollover was triggered on the type %1 with GUID %2 of zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 533 | The keys signing key with GUID %1 on zone %2 that was waiting for a Delegation Signer(DS) update on the parent has been forced to move to rollover completion. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 534 | DNSSEC setting metadata was exported %1 key signing key metadata from zone %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 535 | DNSSEC setting metadata was imported on zone %1. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 536 | A record of type %1, QNAME %2 was purged from scope %3 in cache. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 537 | The forwarder list on scope %2 has been reset to %1. | SETTING_MODIFICATION | target.resource.name is set to "Forwarder list on scope: %{scope_name}" |
| 540 | The root hints have been modified. | SETTING_MODIFICATION | target.resource.name populated with text "Root hints" |
| 541 | The setting %1 on scope %2 has been set to %3. | SETTING_MODIFICATION | |
| 542 | The scope %1 of DNS server was created. | SETTING_CREATION | |
| 543 | The scope %1 of DNS server was deleted. | SETTING_DELETION | |
| 544 | The DNSKEY with Key Protocol %2, Base64 Data %4 and Crypto Algorithm %5 has been added at the trust point %1. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 545 | The DS with Key Tag: %2, Digest Type: %3, Digest: %5 and Crypto Algorithm: %6 has been added at the trust point %1. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 546 | The trust point at %1 of type %2 has been removed. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 547 | The trust anchor for the root zone has been added. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 548 | A request to restart the DNS server service has been received. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 549 | The debug logs have been cleared from %1 on DNS server. | SYSTEM_AUDIT_LOG_WIPE | |
| 550 | The in-memory contents of all the zones on DNS server have been flushed to their respective files. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 551 | All the statistical data for the DNS server has been cleared. | SYSTEM_AUDIT_LOG_WIPE | |
| 552 | A resource record scavenging cycle has been started on the DNS Server. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 553 | %1 | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 554 | The resource record scavenging cycle has been terminated on the DNS Server. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 555 | The DNS server has been prepared for demotion by removing references to it from all zones stored in the Active Directory. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 556 | The information about the root hints on the DNS server has been written back to the persistent storage. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 557 | The addresses on which DNS server will listen has been changed to %1. | SETTING_MODIFICATION | target.resource.name populated with text "Listen Addresses" |
| 558 | An immediate RFC 5011 active refresh has been scheduled for all trust points. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 559 | The zone %1 is paused. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 560 | The zone %1 is resumed. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 561 | The data for zone %1 has been reloaded from %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 562 | The data for zone %1 has been refreshed from the master server %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 563 | The secondary zone %1 has been expired and new data has been requested from the master server %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 564 | The zone %1 has been reloaded from the Active Directory. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 565 | The content of the zone %1 has been written to the disk and the notification has been sent to all the notify servers. | SETTING_MODIFICATION | |
| 566 | All DNS records at the node %1 in the zone %2 will have their aging time stamp set to the current time.%3 | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 567 | The Active Directory-integrated zone %1 has been updated. Only %2 can run scavenging. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 568 | The key master role for zone %1 has been %2.%3 | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 569 | A %1 singing key (%2) descriptor has been added on the zone %3 with following properties: KeyId=%4; KeyType=%5; CurrentState=%6; KeyStorageProvider=%7; StoreKeysInAD=%8; CryptoAlgorithm=%9; KeyLength=%10; DnsKeySignatureValidityPeriod=%11; DSSignatureValidityPeriod=%12; ZoneSignatureValidityPeriod=%13; InitialRolloverOffset=%14; RolloverPeriod=%15; RolloverType=%16; NextRolloverAction=%17; LastRolloverTime=%18; NextRolloverTime=%19; CurrentRolloverStatus=%20; ActiveKey=%21; StandbyKey=%22; NextKey=%23. The zone will be resigned with the %2 generated with these properties. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 570 | A %1 singing key (%2) descriptor with GUID %3 has been updated on the zone %4. The properties of this %2 descriptor have been set to: KeyId=%5; KeyType=%6; CurrentState=%7; KeyStorageProvider=%8; StoreKeysInAD=%9; CryptoAlgorithm=%10; KeyLength=%11; DnsKeySignatureValidityPeriod=%12; DSSignatureValidityPeriod=%13; ZoneSignatureValidityPeriod=%14; InitialRolloverOffset=%15; RolloverPeriod=%16; RolloverType=%17; NextRolloverAction=%18; LastRolloverTime=%19; NextRolloverTime=%20; CurrentRolloverStatus=%21; ActiveKey=%22; StandbyKey=%23; NextKey=%24. The zone will be resigned with the %2 generated with these properties. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 571 | A %1 singing key (%2) descriptor %4 has been removed from the zone %3. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 572 | The state of the %1 signing key (%2) %3 has been modified on zone %4. The new active key is %5, standby key is %6 and next key is %7. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 573 | A delegation for %1 in the scope %2 of zone %3 with the name server %4 has been added. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 574 | The client subnet record with name %1 value %2 has been added to the client subnet map. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 575 | The client subnet record with name %1 has been deleted from the client subnet map. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 576 | The client subnet record with name %1 has been updated from the client subnet map. The new client subnets that it refers to are %2. | SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| 577 | A server level policy %6 for %1 has been created on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5. | SETTING_CREATION | |
| 578 | A zone level policy %8 for %1 has been created on zone %6 on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5; Scopes:%7. | SETTING_CREATION | |
| 579 | A forwarding policy %6 has been created on server %2 with following properties: ProcessingOrder:%3; Criteria:%4; Action:%5; Scope:%1. | SETTING_CREATION | |
| 580 | The server level policy %1 has been deleted from server %2. | SETTING_DELETION | |
| 581 | The zone level policy %1 has been deleted from zone %3 on server %2. | SETTING_DELETION | |
| 582 | The forwarding policy %1 has been deleted from server %2. | SETTING_DELETION |