Does someone know if it's possible to ingest Windows DNS logs without using NXLog paid version?

[Roberto_Del]

Does someone know if it's possible to ingest Windows DNS logs without using NXLog paid version? Even with other tools like filebeat, does the default parser work?

[Drew_Pilarski]

dont know but i also would really like to get a testimonay from another customer using something besides paid nxlog or cribl

[Roberto_Del]

@Drew_Pilarski after some digging, it seems like only NXLog Enterprise can take the logs from the event viewer. Even Beats can't https://github.com/elastic/beats/issues/2073

[cmmartin_google]

You can use the Windows DNS log file, but there can be challenges with it, see - https://nxlog.co/news-and-blog/posts/disappearing-dns-debug-log

[cmmartin_google]

Otherwise, for high volume then NX Log Enterprise has ETW support

[cmmartin_google]

But an alternative, if the DNS servers are VMs, is use a span / packet mirror to a Chronicle Forwarder listening for DNS

[cmmartin_google]

WinPacketBeat can be installed on the VMs and works to capture DNS via libpcap (if performance isn't an issue)

[Roberto_Del]

Thank you for the information!

[pigram86]

What about using MS sysmon and capturing DNS with event ID 22 and send to a windows event collector (wec)?

[Roberto_Del]

Have you tried it?

[pigram86]

I have Ms SYSMON running on a majority of my clients and grabbing it all with WEC, but mine is gong to LogRhythm and not Chronicle SIEM. But in theory it should work as in previous position I did the same with nxlog grabbing sysmon to an ELK stack. 

https://docs.nxlog.co/userguide/integrate/sysmon.html

Now for simplicity, you can just use swiftonsecurity sysmon config. But if you want granular control, I recommend Olaf Hartong's. 

https://github.com/SwiftOnSecurity/sysmon-config

https://github.com/olafhartong/sysmon-modular

Again, I don't know your environment so YMMV,