{
  "Name": "Windows Server DNS",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/DNS.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [DNS](https://docs.microsoft.com/windows-server/networking/dns/dns-top) solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.\n\nInstalling this solution will deploy two data connectors,\n\r\n1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector.\r\n\n2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\r\n<P style=\"color:red\">**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.",
  "Data Connectors": [
    "Data Connectors/template_DNS.json",
    "Data Connectors/template_ASimDnsActivityLogs.json"
  ],
  "Workbooks": [
    "Workbooks/Dns.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/DNS_HighNXDomainCount_detection.yaml",
    "Analytic Rules/DNS_HighReverseDNSCount_detection.yaml",
    "Analytic Rules/DNS_Miners.yaml",
    "Analytic Rules/DNS_TorProxies.yaml",
    "Analytic Rules/NRT_DNS_Related_To_Mining_Pools.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/DNS_CommonlyAbusedTLDs.yaml",
    "Hunting Queries/DNS_DomainAnomalousLookupIncrease.yaml",
    "Hunting Queries/DNS_FullNameAnomalousLookupIncrease.yaml",
    "Hunting Queries/DNS_HighPercentNXDomainCount.yaml",
    "Hunting Queries/DNS_HighReverseDNSCount.yaml",
    "Hunting Queries/DNS_LongURILookup.yaml",
    "Hunting Queries/DNS_WannaCry.yaml",
    "Hunting Queries/Solorigate-DNS-Pattern.yaml",
    "Hunting Queries/Solorigate-Encoded-Domain-URL.yaml"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Windows Server DNS",
  "Version": "3.0.1",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "StaticDataConnectorIds": [
    "ASimDnsActivityLogs",
    "DNS"
  ]
}