Security Analytics for DNS logs

blason · July 12, 2023, 3:41am

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.8

Describe the issue: I am ingesting BIND logs from Linux DNS server and I have parsed those using logstash. Since I wanted to use security analytics and rules pertaininig to DNS wondering what common schema should I follow? Should I use ECS or any other so that my rules will start matching the logs?

Configuration:

Relevant Logs or Screenshots:

system · September 10, 2023, 3:41am

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Feedback: Experimental Feature - Security Analytics General Feedback	10	707	January 3, 2023
Can we detect DNS DGA or Tunneling attack using Anomaly detection Open Source Elasticsearch and Kibana	1	389	February 7, 2023
What log sources do you need for Security Analytics Security Analytics	5	518	June 20, 2023
Issues with Security Analytics and indexes/shards Security Analytics troubleshoot	1	195	December 16, 2023
Using security analytics is hard mostly because of a lack of documentation Security Analytics	37	1305	April 27, 2024

Security Analytics for DNS logs

Related Topics