Syslog - Collecting Internal DNS

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Syslog - Collecting Internal DNS

L1 Bithead

Hey Everyone,

 

I noticed my Syslog box isn't receiving internal DNS information from the Palo.  I originally thought the URL log type would capture internal information (yes i'm aware what URL stands for, but I could hope).  However that doesn't seem to be the case.

 

Is there a particular field, log type, or severity level I can enable to collect internal dns names and services?

 

- Jeff

12 REPLIES 12

Cyber Elite
Cyber Elite

Hello,

I'm not sure if hte PAN does this for you or if there is a way to accomplish this. However for us our SIEM does this on its end.

 

Regards,

What are you actualy trying to achive/log?

 

Rob

Trying to collect internal dns records in Palo Alto's Splunk app.  That way we can better correlate events and threats when they happen.

@JeffFredericks

Do you want to have DNS logs in your Splunk server or do you want the DNS names for the IPs in the logs? For the names you can export the DNS Names and create a lookup table on your splunk server.

DNS Names for the IPs in the logs.

I would love to know how to export that info.

Do we assume your DNS server is Windows Server??

And are all your IP's static/reserverd?

Windows Server + Static/reserved

You can export the zone via MMC, or you could powershel the export and run it periodicaly.

 

Rob

Interesting.  From what you described It sounds a little bit more like a hack, then an actual filter or setting with the Palo Alto as well.


Selecting, say, the url field for syslog won't capture internal DNS requests as they're hitting the Palo?

@JeffFredericks

The way described by @RobinClayton isn't a hack. This is how it should be as the firewall also does not know the DNS names of the sources (except if you create address objects for ALL your internal systems). This information you should get where it is managed -> from your DNS server.

 


@JeffFredericks wrote:

Selecting, say, the url field for syslog won't capture internal DNS requests as they're hitting the Palo?


No, paloalto does not log the content of DNS requests. If you need this data, then the best place to get that is agsin your DNS server which you need to configure to send the DNS logs to your splunk server.

Even if the PA did see the DNS requests ( if you had the DNS servers on their own Zone or Subnet) routed through the firewall.... The PA is not goign to do anything special with the traffic.

 

 

  • 4336 Views
  • 12 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!