DNS Log Collection and Parsing

DNS log collection and parsing should be part of the log collection strategy of every modern IT infrastructure. There are numerous reasons why you should be concerned enough to collect as well as parse the DNS logs collected, some of which include:

For more information on this topic see, The Importance of DNS Logging in Enterprise Security white paper.

Hardening IT security through DNS log collection can be challenging due to the following reasons:

Despite these obstacles, there are good security trade-offs that can be made by collecting DNS logs. The benefits associated with DNS parsing include:

Parsing DNS server logs can provide additional security insights. For instance, known malicious domain lists are available for filtering log files for signs of the presence of such domains. Other use cases include finding requests to C2 servers, detecting potential DoS attacks, DNS hijacking attacks, as well as attacks using DGA (Domain generation algorithm) which generate more opportunities for C2 rendezvous points.

Example: Parsing DNS Logs for NXDOMAIN Responses

An administrator used the dig command which showed a seemingly harmless NXDOMAIN related result:

Detection techniques for the above example include reactionary detection which relies on finding contextual metadata in the DNS logs. One such indicator is the parsing of the DNS logs to locate network NXDOMAIN responses generated for cases when there are errors in the request, such as the domain not being registered. It can either be benign, such as an application using DNS anti-spoofing mechanism, or it can be a sign of something more malicious.

Excessive DNS logging can be resource intensive. It can slow down production systems by negatively affecting local storage. Therefore, consolidating DNS logs on a centralized logging server should be considered, while keeping in mind restrictions on logging rates, such as maximum EPS (events per second).

Failing to place adequate measures on parsing could result in an excessive amount of logs that may prove difficult to manage. It might also present the additional challenge of log standardization which is essential to the proper correlation of data.

The following are tips to consider when planning DNS logging:

Planning the monitoring and collection of DNS logs might not seem straightforward at first sight given all the considerations that must be addressed, but the rewards can be substantial: reducing operating costs, more effectively securing sensitive data, and greater ease in meeting regulatory compliance requirements, just to mention a few.

In many cases, having to collect and process multiple log formats from multiple types of log sources is a daunting task requiring multiple tools running on multiple operating systems. Increased complexity normally equates to an increased budget for the additional resources required.

Implementing the following two strategies is pivotal for effectively monitoring DNS Logs.

Ideally, once all the requisite DNS events and logs have been collected, they need to be parsed, enriched, and forwarded to a centralized logging server where they can be easily accessed and audited by security analysts.

Now that some of the benefits, challenges, and goals of DNS log collection in general have been established, the next two parts, Part 2 and Part3 of this series will address the various DNS log sources and some approaches for effectively collecting them from different DNS server environments on Windows and Linux systems respectively.