Enabling DNS Log Enrichment on Linux

1 Requirements

First, make sure our log servers are reachable. You can find the networking requirements here:

Technical Requirements

Note: The above article is only available for SecureDNS customer accounts.

2 Installing Filebeat

Next, follow these steps based on your Linux distribution:

For Debian:

1. Download and install the Public Signing Key:

   1. wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

2. You may need to install the apt-transport-https package on Debian before proceeding:

   1. sudo apt install apt-transport-https

3. Save the repository definition to /etc/apt/sources.list.d/elastic-8.x.list:

   1. echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list

4. Run apt-get update, and the repository is ready for use. For example, you can install Filebeat by running:

   1. sudo apt update ; sudo apt install filebeat

5. To configure Filebeat to start automatically during boot, run:

   1. sudo systemctl enable filebeat

6. If your system does not use systemd then run:

   1. sudo update-rc.d filebeat defaults 95 10

For Red Hat:

1. Download and install the public signing key:

   1. sudo rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

2. Create a file with a .repo extension (for example, elastic.repo) in your /etc/yum.repos.d/ directory and add the following lines:

   1. [elastic-8.x]
      name=Elastic repository for 8.x packages
      baseurl=https://artifacts.elastic.co/packages/8.x/yum
      gpgcheck=1
      gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
      enabled=1
      autorefresh=1
      type=rpm-md

3. Your repository is ready to use. For example, you can install Filebeat by running:

   1. sudo yum install filebeat

4. To configure Filebeat to start automatically during boot, run:

   1. sudo systemctl enable filebeat

5. If your system does not use systemd then run:

   1. sudo chkconfig --add filebeat

Download the certificates and replace the configuration file

1. Download our certificates and config file here: https://portal.secutec.com/documents -> Configuration -> SecureDNS_Filebeat_Linux_Config+Certs2023.
2. Unzip the folder on the system and move the contents to /etc/filebeat/
   1. Make sure to replace the existing filebeat.yml with the one provided from the download link.
3. Open the newly replaced filebeat.yml with a text editor and adapt the following parameters:
   1. paths:
      1. Should contain the path where your local DNS logs are stored. Example:
         1.  /var/lib/bind/*.log
   2. fields:
      1. client: and site: Should contain the customer and site name that was configured as seen in the portal. Example:
         1. client: customer
         2. site: hq
   3. output.logstash:
      1. the 3 ssl paths should contain the downloaded certificates. Please double check if they are stored in the right location and adapt the path if needed.
4. Test the config file with this command:

   1. filebeat test config

5. Test the output with this command:

   1. filebeat test output

6. If the TCP handshakes are successful, and there is no error in the config file. We should be receiving the logs. Please check your Firewall if you can see outgoing traffic over port 6044.