{
  "id": "DNS",
  "title": "DNS",
  "publisher": "Microsoft",
  "descriptionMarkdown": "The DNS log connector allows you to easily connect your DNS analytic and audit logs with Microsoft Sentinel, and other related data, to improve investigation.\n\n**When you enable DNS log collection you can:**\n-   Identify clients that try to resolve malicious domain names.\n-   Identify stale resource records.\n-   Identify frequently queried domain names and talkative DNS clients.\n-   View request load on DNS servers.\n-   View dynamic DNS registration failures.\n\nFor more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220127&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
  "logo": "DNS.svg",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "DnsEvents",
      "baseQuery": "DnsEvents"
    },
    {
      "metricName": "Total data received",
      "legend": "DnsInventory",
      "baseQuery": "DnsInventory"
    }
  ],
  "sampleQueries": [
    {
      "description": "All events logs",
      "query": "DnsEvents\n            | sort by TimeGenerated"
    },
    {
      "description": "All inventory logs",
      "query": "DnsInventory\n            | sort by TimeGenerated"
    }
  ],
  "dataTypes": [
    {
      "name": "DnsEvents",
      "lastDataReceivedQuery": "DnsEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    },
    {
      "name": "DnsInventory",
      "lastDataReceivedQuery": "DnsInventory\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    { "type": "OmsSolutions", "value": ["DnsAnalytics"] }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": { "read": true, "write": true, "delete": true }
      },
      {
        "provider": "Microsoft.OperationalInsights/solutions",
        "permissionsDisplayText": "[read and write permissions](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#log-analytics-contributor).",
        "providerDisplayName": "Solutions",
        "scope": "ResourceGroup",
        "requiredPermissions": { "read": true, "write": true }
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "1. Download and install the agent",
      "description": ">  DNS logs are collected only from **Windows** agents.",
      "instructions": [
        {
          "parameters": {
            "title": "Choose where to install the agent:",
            "instructionSteps": [
              {
                "title": "Install agent on Azure Windows Virtual Machine",
                "description": "Download the agent on the relevant machine and follow the instructions.",
                "instructions": [
                  {
                    "parameters": {
                      "linkType": "InstallAgentOnVirtualMachine"
                    },
                    "type": "InstallAgent"
                  }
                ]
              },
              {
                "title": "Install agent on non-Azure Windows Machine",
                "description": "Select the machine to install the agent and then click **Connect**.",
                "instructions": [
                  {
                    "parameters": { "linkType": "InstallAgentOnNonAzure" },
                    "type": "InstallAgent"
                  }
                ]
              }
            ]
          },
          "type": "InstructionStepsGroup"
        }
      ]
    },
    {
      "title": "2. Install DNS solution",
      "instructions": [
        {
          "parameters": { "solutionName": "DnsAnalytics" },
          "type": "OmsSolutions"
        }
      ]
    }
  ]
}