Syslog - Collecting Internal DNS

[JeffFredericks]

Hey Everyone,

I noticed my Syslog box isn't receiving internal DNS information from the Palo.  I originally thought the URL log type would capture internal information (yes i'm aware what URL stands for, but I could hope).  However that doesn't seem to be the case.

Is there a particular field, log type, or severity level I can enable to collect internal dns names and services?

- Jeff

[OtakarKlier]

Hello,

I'm not sure if hte PAN does this for you or if there is a way to accomplish this. However for us our SIEM does this on its end.

Regards,

[RobinClayton]

What are you actualy trying to achive/log?

Rob

[JeffFredericks]

Trying to collect internal dns records in Palo Alto's Splunk app.  That way we can better correlate events and threats when they happen.

[Remo]

@JeffFredericks

Do you want to have DNS logs in your Splunk server or do you want the DNS names for the IPs in the logs? For the names you can export the DNS Names and create a lookup table on your splunk server.

[JeffFredericks]

DNS Names for the IPs in the logs.

I would love to know how to export that info.

[RobinClayton]

Do we assume your DNS server is Windows Server??

[RobinClayton]

And are all your IP's static/reserverd?

[JeffFredericks]

Windows Server + Static/reserved

[RobinClayton]

You can export the zone via MMC, or you could powershel the export and run it periodicaly.

Rob

[JeffFredericks]

Interesting.  From what you described It sounds a little bit more like a hack, then an actual filter or setting with the Palo Alto as well.

Selecting, say, the url field for syslog won't capture internal DNS requests as they're hitting the Palo?

[Remo]

@JeffFredericks

The way described by @RobinClayton isn't a hack. This is how it should be as the firewall also does not know the DNS names of the sources (except if you create address objects for ALL your internal systems). This information you should get where it is managed -> from your DNS server.

---

@JeffFredericks wrote:

Selecting, say, the url field for syslog won't capture internal DNS requests as they're hitting the Palo?

---

No, paloalto does not log the content of DNS requests. If you need this data, then the best place to get that is agsin your DNS server which you need to configure to send the DNS logs to your splunk server.

[RobinClayton]

Even if the PA did see the DNS requests ( if you had the DNS servers on their own Zone or Subnet) routed through the firewall.... The PA is not goign to do anything special with the traffic.