I noticed my Syslog box isn't receiving internal DNS information from the Palo. I originally thought the URL log type would capture internal information (yes i'm aware what URL stands for, but I could hope). However that doesn't seem to be the case.
Is there a particular field, log type, or severity level I can enable to collect internal dns names and services?
I'm not sure if hte PAN does this for you or if there is a way to accomplish this. However for us our SIEM does this on its end.
Do you want to have DNS logs in your Splunk server or do you want the DNS names for the IPs in the logs? For the names you can export the DNS Names and create a lookup table on your splunk server.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!