Viewing Hostnames

[vaschthestampede]

Linking to this discussion I would also need to have evidence of the hostnames.
#14384

In practice I would need to have a trend over time of the association between hostname - IP - mac address.

[dougburks]

Depending on your network architecture and what exactly you're trying to do, you may want to consider one or more of the following options:

• turn on Reverse DNS lookups and/or Local Lookups as shown at https://docs.securityonion.net/en/2.4/soc-customization.html#reverse-dns
• go to SOC Dashboards and select the DNS dashboard to see the hostnames in your DNS traffic as seen by your network sensor(s)
• go to SOC Dashboards and select the DHCP dashboard to see the hostnames in your DHCP traffic as seen by your network sensor(s)
• you may want to consume DNS logs directly from your DNS server(s) and/or DHCP logs directly from your DHCP server(s). This might be via Elastic Integration. For example, the microsoft_dhcp integration (https://www.elastic.co/guide/en/integrations/current/microsoft_dhcp.html).

[vaschthestampede]

So the DHCP query looks very promising, only the MAC address information is missing.
Is there a way to modify the query to include the MAC as well?
Edit:
I found it.
You don't need to change the query, just add the "host.mac" column by opening a record.

We are almost there, now I need a way to export (in CSV for example) the results of the "Events" table even exceeding the 5000 Fetch limit.

[dougburks]

We are almost there, now I need a way to export (in CSV for example) the results of the "Events" table even exceeding the 5000 Fetch limit.

You might want to consider a tool like elasticsearch-dump or manually querying the Elasticsearch API.

[vaschthestampede]

I think I solved it with kibana.
In kibana I went into discovery and set the filters with event.dataset:zeek.dhcp, then I can save and extract to csv.

Using the API might be handy later, so maybe I'll come back.