Microsoft Windows DNS Integration

TL;DR

Overview

Windows DNS Server is Microsoft's name resolution service running on Windows Server, widely deployed in Active Directory environments to provide authoritative DNS for internal domains. This integration ingests the DNS Server Audit event channel (Microsoft-Windows-DNSServer/Audit), which primarily records dynamic DNS update operations — such as resource record creation and deletion performed by clients via Dynamic DNS Update (DDNS). Each event captures the record type, name, TTL, RDATA, zone, and the source IP address that initiated the update. These logs provide security teams with visibility into which hosts are registering or removing DNS records on internal infrastructure, enabling detection of unauthorized or anomalous dynamic DNS updates, rogue host registrations, DNS zone poisoning attempts, and reconnaissance activity targeting Active Directory domain controllers.

Supported data types

Windows DNS Server Audit Logs

Table name: windows_dns_server_audit_logs

This data type contains DNS Server Audit events (e.g., EventID 519/520) generated when DNS records are created or deleted on a Windows DNS Server via Dynamic DNS Update. Each record includes the resource record type, name, TTL, RDATA, zone and zone scope, and the source IP address that initiated the update, along with standard Windows Event System metadata (event record ID, computer, provider, channel, process/thread IDs). These events are useful for identifying unauthorized or anomalous dynamic DNS registrations, rogue host activity, and potential DNS zone poisoning within Active Directory environments.

Expected format

Logs are expected in nested JSON/XML format — a JSON envelope (with _time, host, and source fields) wrapping a raw Windows Event XML document in the _raw field.

{ "_raw": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-DNSServer' Guid='{eb79061a-a566-4698-9119-3ed2807060e7}'/><EventID>519</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x4000000002000000</Keywords><TimeCreated SystemTime='2026-05-19T15:38:50.3994764Z'/><EventRecordID>9864805</EventRecordID><Correlation/><Execution ProcessID='2932' ThreadID='3724'/><Channel>Microsoft-Windows-DNSServer/Audit</Channel><Computer>prd-ads-dc-1.example.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Type'>1</Data><Data Name='NAME'>DSZH3T3</Data><Data Name='TTL'>1200</Data><Data Name='BufferSize'>4</Data><Data Name='RDATA'>0A82AA89</Data><Data Name='Zone'>example.local</Data><Data Name='ZoneScope'>Default</Data><Data Name='Source'>172.21.45.112</Data></EventData><RenderingInfo Culture='en-US'><Message>A resource record of type 1, name DSZH3T3, TTL 1200 and RDATA 0x0A82AA89 was created in scope Default of zone example.local via dynamic update from IP Address 172.21.45.112.</Message><Level>Information</Level><Task>DYNAMIC_UPDATE</Task><Opcode>Info</Opcode><Channel>Microsoft-Windows-DNS-Server/Audit</Channel><Provider>Microsoft-Windows-DNS-Server</Provider><Keywords></Keywords></RenderingInfo></Event>", "_time": 1779205130.399, "host": "prd-wec-as-3", "source": "Supercharger-Destination-ADDNSLogs/Log" }

Send data to Hunters

Hunters supports the collection of Windows DNS Server Audit logs using Amazon S3.

To connect Windows DNS Server Audit logs:

1. Collect the DNS Server Audit event channel (Microsoft-Windows-DNSServer/Audit) from your Windows DNS Servers or domain controllers. This is typically done using a Windows Event Collector (WEC) subscription or a log forwarding agent, and may be routed through an intermediary log shipper (e.g., a Splunk/Cribl-style forwarder) before delivery to storage. See Microsoft's guidance on connecting DNS logs via Azure Monitor Agent and NXLog's DNS monitoring documentation for reference architectures, and the DNS Analytical Log blog series for background on the DNS audit/analytical event channels.
2. Configure your log shipper or collection pipeline to write the collected events into an AWS S3 bucket, with each event wrapped as a JSON object containing the raw Windows Event XML (_raw) along with _time, host, and source fields.
3. Once logs are in S3, follow the steps in this section to connect the S3 bucket to Hunters.