Enable Windows DNS logs
Overview
DNS is a system that is used in TCP/IP networks for naming computers and network services. DNS naming locates computers and services through user-friendly names. When a user enters a DNS name in an application, DNS services can resolve the name to other information that is associated with it, such as an IP address.
Configuration
DNS debug logging
Open the DNS Manager with the following command: dnsmgmt.msc.
Right-click the DNS server and click Properties.
Click the Debug Logging tab.
Select Log packets for debugging.
Enter the File path and name, and Maximum size.
Click Apply and OK.
Configuration sample:
Endpoint Agent Manager
Using ansible roles (recommended)
Locate the inventory file we used in your Devo EA Manager deployment.
Open it with your preferred text editor, search for
deam_fleet_config_devoext_fetchfiles_paths_win
(or add it undervars
if you have no previously configured fetchfiles) and add a new pattern with our previously configured log file path, a custom tag and multiline processing enabled with the following regular expression as a separator:'^\d\d?/\d\d?/\d{4}'
The following screenshot shows a configuration sample:
If you are running a new deployment, continue with the normal process of deployment, the change will not be applied until the devo-endpoint-agent
playbook is run.
If you have an existing deployment:
Enable the virtual environment by running:
source "/opt/ansible-2.9/venv/bin/activate"
Run the
deam-packs
playbook from your deployer folder to apply the configuration:ansible-playbook -i inventories/<your_inventory_name>.yaml playbooks/deam-packs.yaml
Endpoints will refresh their configuration every X seconds according to the config_refresh
parameter. If the configuration is not refreshed automatically after the period has passed, you may need to restart the endpoints so the configuration takes place.
Use admin page in EA Manager Web UI
Please be aware that modifying the osquery configuration via the WebUI, just applies to the actual config instance of EA Manager and do not replicates the change to the inventory file in the ansible playbook. This means that the changes in configuration done in the Web UI, need to be consolidated to the inventory file in the ansible playbooks before performing any new deployment in the ansible or applied changes will be overwritten.
Log in to your Devo EA Manager administration console (
https://<devo_ea_manager_ip>:8080
)Once logged in, access the osquery configuration in
https://<DEAM_IP:8080>/
-> settings -> Global agent optionsHere, we will see a text editor with the default configuration values and the ones loaded from DEA Manager inventory file as in the following screenshot:
Â
We need to search for the
windows
->devo_extensions
->fetchfiles
section and add our previously configured log file path with a custom tag and multiline processing enabled with the following regular expression as a separator:content_separator: '^\d\d?/\d\d?/\d{4}'
Configuration sample:Â
Remember to follow these steps if you have previously deployed the pattern in fetchfiles.
Sending to Devo
These events uses fetchfiles query added by default in the DevoFetchFilesPack
pack, so if DevoFetchFilesPack
pack is enabled, it isn’t necessary to change anything else.
Data access
By default, content files will be ingested line by line into Devo under box.devo_ea.files.dns_windows
They can also be seen in the parent table, box.devo_ea.files