Import DNS

[tommorgan365]

Is there a way to import DNS data - so that the data shows the dns name and not the ip?

[greatapoc]

Along the same vein - I'd be thrilled if there was a button on Hunt/Alerts for "Resolve Hostname" or something like that. Click it and have all the IP values in src/dst/etc show hostnames.

[weslambert]

Is there a way to import DNS data - so that the data shows the dns name and not the ip?

Have you considered something like the DNS filter plugin for Logstash? We typically recommend Ingest parsing, but you might be able to break out a portion of the pipeline for Logstash and the rest for Ingest.

https://www.elastic.co/guide/en/logstash/7.x/plugins-filters-dns.html

[chadlangston]

+1 for me! I was just about to ask the same question. I'd love to be able to point Security Onion to my local DNS resolver so that is would do reverse lookups on the ip addresses and fill in the DNS names!

Wes, would your DNS filter plugin for Logstash suggestion make this possible? Would this replace IP addresses in the Hunt view and everywhere else the source.ip and destination.ip fields are used?

[johnprose]

This seems like an obvious one. It would be very useful for my setup. Anyone with advice?

[dougburks]

One option might be the Elasticsearch enrich processor:
https://www.elastic.co/guide/en/elasticsearch/reference/current/enrich-processor.html