This article will cover how DNS traffic can be filtered and analyzed.
Filtering DNS Traffic
When the data is parsed into relevant columns, it is separated along with the columns created by Logsign to enrich the data but not present in the incoming raw data. In the screenshot below, the event type has been determined as DNS based on this enriched data, and only the data related to DNS traffic has been filtered out from all the data in a simple manner.
The screenshot below shows which sources the incoming DNS data came from.
In the screenshot below, data related to Google within the DNS data has been filtered out, and using intelligent filtering, the hosts with which the traffic was generated are shown.