---
title: "Microsoft Windows DNS Integration"
slug: "windows-dns"
updated: 2026-11-02T16:40:34Z
published: 2026-11-02T16:40:34Z
canonical: "docs.hunters.ai/windows-dns"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Windows DNS Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Windows DNS Server Audit Logs |  | ✅ | ✅ |  | `windows_dns_server_audit_logs` | Nested JSON/XML | S3 |

## Overview

Windows DNS Server is Microsoft's name resolution service running on Windows Server, widely deployed in Active Directory environments to provide authoritative DNS for internal domains. This integration ingests the DNS Server Audit event channel (`Microsoft-Windows-DNSServer/Audit`), which primarily records dynamic DNS update operations — such as resource record creation and deletion performed by clients via Dynamic DNS Update (DDNS). Each event captures the record type, name, TTL, RDATA, zone, and the source IP address that initiated the update. These logs provide security teams with visibility into which hosts are registering or removing DNS records on internal infrastructure, enabling detection of unauthorized or anomalous dynamic DNS updates, rogue host registrations, DNS zone poisoning attempts, and reconnaissance activity targeting Active Directory domain controllers.

## Supported data types

### Windows DNS Server Audit Logs

**Table name:** `windows_dns_server_audit_logs`

This data type contains DNS Server Audit events (e.g., EventID 519/520) generated when DNS records are created or deleted on a Windows DNS Server via Dynamic DNS Update. Each record includes the resource record type, name, TTL, RDATA, zone and zone scope, and the source IP address that initiated the update, along with standard Windows Event System metadata (event record ID, computer, provider, channel, process/thread IDs). These events are useful for identifying unauthorized or anomalous dynamic DNS registrations, rogue host activity, and potential DNS zone poisoning within Active Directory environments.

**Expected format**

Logs are expected in nested JSON/XML format — a JSON envelope (with `_time`, `host`, and `source` fields) wrapping a raw Windows Event XML document in the `_raw` field.

```
{ "_raw": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-DNSServer' Guid='{eb79061a-a566-4698-9119-3ed2807060e7}'/><EventID>519</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x4000000002000000</Keywords><TimeCreated SystemTime='2026-05-19T15:38:50.3994764Z'/><EventRecordID>9864805</EventRecordID><Correlation/><Execution ProcessID='2932' ThreadID='3724'/><Channel>Microsoft-Windows-DNSServer/Audit</Channel><Computer>prd-ads-dc-1.example.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Type'>1</Data><Data Name='NAME'>DSZH3T3</Data><Data Name='TTL'>1200</Data><Data Name='BufferSize'>4</Data><Data Name='RDATA'>0A82AA89</Data><Data Name='Zone'>example.local</Data><Data Name='ZoneScope'>Default</Data><Data Name='Source'>172.21.45.112</Data></EventData><RenderingInfo Culture='en-US'><Message>A resource record of type 1, name DSZH3T3, TTL 1200 and RDATA 0x0A82AA89 was created in scope Default of zone example.local via dynamic update from IP Address 172.21.45.112.</Message><Level>Information</Level><Task>DYNAMIC_UPDATE</Task><Opcode>Info</Opcode><Channel>Microsoft-Windows-DNS-Server/Audit</Channel><Provider>Microsoft-Windows-DNS-Server</Provider><Keywords></Keywords></RenderingInfo></Event>", "_time": 1779205130.399, "host": "prd-wec-as-3", "source": "Supercharger-Destination-ADDNSLogs/Log" }
```

## Send data to Hunters

Hunters supports the collection of Windows DNS Server Audit logs using Amazon S3.

**To connect Windows DNS Server Audit logs:**

1. Collect the DNS Server Audit event channel (`Microsoft-Windows-DNSServer/Audit`) from your Windows DNS Servers or domain controllers. This is typically done using a Windows Event Collector (WEC) subscription or a log forwarding agent, and may be routed through an intermediary log shipper (e.g., a Splunk/Cribl-style forwarder) before delivery to storage. See Microsoft's guidance on [connecting DNS logs via Azure Monitor Agent](https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama) and [NXLog's DNS monitoring documentation](https://docs.nxlog.co/integrations/dns/dns-monitoring-windows.html) for reference architectures, and the [DNS Analytical Log blog series](https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/secrets-from-the-deep-%E2%80%93-the-dns-analytical-log-%E2%80%93-part-5/3191119) for background on the DNS audit/analytical event channels.
2. Configure your log shipper or collection pipeline to write the collected events into an AWS S3 bucket, with each event wrapped as a JSON object containing the raw Windows Event XML (`_raw`) along with `_time`, `host`, and `source` fields.
3. Once logs are in S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3) to connect the S3 bucket to Hunters.