How to get/send DNS logs to on-prem SIEM -- DNS Proxy + DNS Security

[jgardner150]

Hello Community!

Wondering if anyone has this scenario / has experience with retrieving DNS security logs...

Remote Site Firewall setup:

- DNS Proxy Enabled (Rules direct internal domains to internal DNS servers across SDWAN, all other DNS request go out local internet to 8.8.8.8)

-Firewalls have DNS Security Subscription

Problem: We previously used internal DNS servers for all traffic (due to backhauling internet to the datacenters) and forwarded all DNS server logs to our on-prem SIEM. Now with DNS Proxy + External DNS servers we no longer get the detailed DNS logs we used to.

Partial Solution: We have DNS Security subscriptions on these remote firewalls, it seems that this logs all DNS queries in Palo's cloud, and I can see them in Autofocus... However, we are stumped on how to get these logs made available to pull down / be sent to our on-prem SIEM so we can use the data for event correlation amongst many other log sources

I have been working with our account team to find a solution, but I wanted to float it out here in case anyone has found a solution or has alternate suggestions.

[BPry]

@jgardner150,

You can setup log forwarding from CDL and setup filtering if required so that it isn't sending all logs unless you need it. 

https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-start...

[jgardner150]

@BPry Thanks for the info.

I did a little research and see they added DNS Security logs as source for CDL about a year back: https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-release-notes/cortex-data... .

I'm guessing I'll need to buy a little bit of storage (I currently don't use CDL) to be able to use this option for forwarding the logs I'm looking for. Not ideal, but at least it sounds like it might get the job done.