Collect DNS Query Audit Logs
Description
Collect DNS query audit logs on enterprise assets, where appropriate and supported.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
High-performance log management and observability platform designed for petabyte-scale data with real-time search
CrowdStrike · Per-GB subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
DNS-Based Command and Control Evasion
ConfidentialityMalware communicates with command-and-control infrastructure using DNS tunneling or DNS-over-HTTPS, and without DNS query logging the organization cannot detect these covert channels or identify compromised hosts.
Data Exfiltration via DNS Queries
ConfidentialityAttackers encode stolen data into DNS query subdomains to exfiltrate sensitive information through the DNS protocol, which without query logging appears as normal DNS traffic and bypasses traditional DLP controls.
Malicious Domain Resolution Without Detection
IntegrityEnterprise assets resolve known malicious domains, phishing sites, or newly registered threat infrastructure, but without DNS query logs the security team has no visibility into these indicators of compromise.
Vulnerabilities (When Safeguard Absent)
No DNS Query Logging on Enterprise DNS Servers
Internal DNS servers and resolvers do not have query logging enabled, providing zero visibility into which domains are being resolved by enterprise assets and eliminating a critical data source for threat detection.
DNS Queries Bypass Monitored Resolvers
Endpoints are permitted to make DNS queries directly to external resolvers (8.8.8.8, 1.1.1.1) rather than being forced through enterprise DNS servers, completely bypassing any DNS logging that does exist.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Technical | DNS filtering configuration and block statistics | Monthly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |