DNS server event monitoring

[Taher11]

Hello,
I am running an AD on Windows Server 2019, and I would like Fortisiem to trigger any change or modification made on the DNS server ( adding a new record, deleting a record, etc ... ).

Fortisiem now polls event information from different DCs by using OMI.

[cdurkin_FTNT · Accepted solution]

There are two approaches for this... for your investigation

(1) Collect the DNS Audit Log: (Requires FortiSIEM Windows Agent)
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/d...)

Monitor the Specific DNS Auditing Event Log: Microsoft-Windows-DNSServer/Audit

(2) Native OS Logging: (Via Security Event Log, ok for OMI)
https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/who-moved-the-dns-cheese-aud...

(1) is the best approach,  (2) will generate lots of events as a FYI..

[Taher11]

Thank you for your feedback, I can appreciate more