DNS Security
View DNS Security Logs
Table of Contents
View DNS Security Logs
Where Can I Use
This? | What Do I Need? |
|---|---|
|
|
You can browse, search, and view DNS Security
logs that are automatically generated when DNS Security encounters
a qualifying event. Typically, this includes any domain category
that DNS Security analyzes unless it is specifically configured
with a log severity level of none. Log entries provide numerous
details about the event, including the threat level and, if applicable,
the nature of threat.
DNS Security logs are accessible directly on the firewall or through
Strata Logging Service
-based log viewers (AIOps for NGFW Free
, Cloud Management
, Strata Logging Service
, etc). While the firewall allows you to access malicious
threat log entries that are generated when users make DNS queries, benign DNS requests
are not recorded. DNS Security data is also forwarded to Strata Logging Service
through log forwarding (as threat logs) and DNS Security telemetry (as DNS
Security logs), which are then referenced by various activity log viewer applications.
DNS Security telemetry operates with minimal overhead, which limits the amount of data
sent to Strata Logging Service
; as a result, only a subset of DNS queries are
forwarded to Strata Logging Service
as DNS Security log entries, regardless of
the severity level, threat type, or category. The threat logs for malicious DNS requests
that are forwarded to Strata Logging Service
using log forwarding are available
in their entirety. As a result, Palo Alto Networks recommends viewing logs for malicious
DNS requests as threat logs instead of DNS Security logs.Cloud Management
Cloud Management
Benign DNS queries that have been analyzed by DNS Security are not displayed in the log viewer.
Log in to your
Strata Logging Service
app to access benign DNS log
entries.- Use the credentials associated with your Palo Alto Networks support account and log in to theStrata Cloud Manageron the hub.
- Search for DNS queries that have been processed using DNS Security.
- Select .
- Constrain your search using the threat filter and submit a log query based on the DNS category, for example,threat_category.value = 'dns-c2'to view logs that have been determined to be a C2 domain. To search for other DNS types, replace c2 with another supported DNS category (ddns, parked, malware, etc). Adjust the search criteria as necessary for your search, including additional query parameters (such as the severity level and subtype) along with a date range.
- Select a log entry to view the details of a detected DNS threat.
- The threatCategoryis displayed in theGeneralpane of the detailed log view. Other relevant details about the threat are displayed in their corresponding windows.
PAN-OS & Panorama
- Search for activity on the firewall for queries that have been processed using DNS Security.
- Select and filter based on the DNS category, for example,( category-of-threatid eq dns-c2 )to view logs that have been determined to be a C2 domain. To search for other DNS types, replace c2 with another supported DNS category (ddns, parked, malware, etc).
- Select a log entry to view the details of a detected DNS threat.
- The threatCategoryis displayed in theDetailspane of the detailed log view. Other relevant details about the threat are displayed in their corresponding windows.
AIOps for NGFW Free
AIOps for NGFW Free
Benign DNS queries that have been analyzed by DNS Security are not displayed in the
AIOps for NGFW Free
log viewer. Log in to your Strata Logging Service
app to access benign DNS log entries.- Use the credentials associated with your Palo Alto Networks support account and log in to theAIOps for NGFW Freeapplication on the hub.
- Search for DNS queries that have been processed using DNS Security inAIOps for NGFW Free.
- Select .
- Constrain your search using the threat filter and submit a log query based on the DNS category, for example,threat_category.value = 'dns-c2'to view logs that have been determined to be a C2 domain. To search for other DNS types, replace c2 with another supported DNS category (ddns, parked, malware, etc). Adjust the search criteria as necessary for your search, including additional query parameters (such as the severity level and subtype) along with a date range.
- Select a log entry to view the details of a detected DNS threat.
- The threatCategoryis displayed in theDetailspane of the detailed log view. Other relevant details about the threat are displayed in their corresponding windows.
Strata Logging Service
Strata Logging Service
- Use the credentials associated with your Palo Alto Networks support account and log in to theStrata Logging Serviceapplication on the hub.
- Allocate Storage Based on Log Type. If storage space has not been allocated for DNS Security logs onStrata Logging Service, logging entries will not be viewable throughStrata Logging Service.
- Search for DNS queries that have been processed using DNS Security inStrata Logging Service.
- SelectExploreto open theStrata Logging Servicelog viewer.
- Constrain your search using the threat filter and submit a log query based on the DNS category, for example,threat_category.value = 'dns-c2'to view logs that have been determined to be a C2 domain. To search for other DNS types, replace c2 with another supported DNS category (ddns, parked, malware, etc). Adjust the search criteria as necessary for your search, including additional query parameters (such as the severity level and subtype) along with a date range.
- Select a log entry to view the details of a detected DNS threat.
- The threatCategoryis displayed in theDetailspane of the detailed log view. Other relevant details about the threat are displayed in their corresponding windows.