DNS logging with NXLog

Security advantages of DNS logging

• By proactively monitoring DNS audit logs, network administrators can quickly detect and respond to cyberattacks.
• Forwarding DNS logs to a SIEM allows breaches to be quickly detected thus reducing the response time needed for mending security holes and deploying countermeasures.
• With an effective logging strategy responsible for forwarding quality events to a SIEM, the brunt of intrusion detection can be automated, giving security operations center (SOC) personnel more time for analyzing suspicious alerts and working on security tasks of a more proactive nature.
• Aggregating DNS logs using a centralized log collection strategy while filtering out low-quality events can significantly boost threat detection efficiency. Some fringe benefits of this approach are:
• The cost of storage and processing are reduced since filtering drops the majority of events which are of little or no security interest.
• Event correlation is much easier to realize with streams of events being sent to a centralized logging server where they are aggregated.
• GDPR and other compliance obligations are more easily fulfilled when combined with this centralized architecture and the ability to filter and securely forward specific events needed for compliance to a secure storage location for archival.