---
title: "Microsoft Windows DNS Debug Logs"
slug: "microsoft-windows-dns-debug-logs"
updated: 2025-01-24T12:01:31Z
published: 2025-01-24T12:01:31Z
canonical: "docs.hunters.ai/microsoft-windows-dns-debug-logs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Windows DNS Debug Logs

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/70c9349-microsoft.png)

          Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

## Overview

**Table name:** `windows_dns_debug_logs`

This article explains how to ingest your on-premise [Windows DNS Debug Logs](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn800669(v=ws.11)) to Hunters. These logs hold information on DNS queries (including the queried domain), from Windows Servers in which this role is enabled. Such information is important for Enterprise security coverage and can help in revealing malicious communication.

For more information about the logs' collection and schema see [here](https://nxlog.co/documentation/nxlog-user-guide/windows-dns-server.html).

## Send data to Hunters

Once the export is completed and the logs are collected to S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3).

## Expected format

In each log file, the events should be separated by a new-line, where each event has a standard format as in the following example:

```
4/20/2021 20:04:21 PM 09B0 PACKET  00000000014E0010 UDP Snd 192.168.1.200        3122 R Q [8081   DR  NOERROR] A      (7)hunters(2)ai(0)
```