This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Register Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions

Microsoft DNS Log

MaximilianoCitt
Frequent Contributor
Frequent Contributor

‎2017-08-03 12:17 PM

Hi! I want to collect the events of a Microsoft DNS Server. But I don't want to collect the clients queries and server response, instead I want to collect the modifications that are made over the DNS Server, like an audit log. Is that possible? It must be done using winrm? any help is very appreciated.

0 Likes
2 REPLIES 2

EricPartington
Employee
Employee

‎2018-10-02 10:56 AM

I think this would be satisfied with the latest NW Endpoint agent collecting your local event channel

 

channel name

Microsoft-Windows-DNS-Server/Audit

 

pastedImage_1.png

Add that to the NW Endpoint agent config for channel capture to pull in the events via the Windows log parser following this method

https://community.rsa.com/community/products/netwitness/blog/2018/10/02/windows-endpoint-logging-with-netwitness-insights-agent 

MaximilianoCitt
Frequent Contributor
Frequent Contributor
In response to EricPartington

‎2018-10-10 08:24 PM

Thank you so much Eric!

0 Likes
© 2022 RSA Security LLC or its affiliates. All rights reserved.