{
    "id": "ASimDnsActivityLogs",
    "title": "Windows DNS Events via AMA",
    "publisher": "Microsoft",
    "descriptionMarkdown": "The Windows DNS log connector allows you to easily filter and stream all analytics logs from your Windows DNS servers to your Microsoft Sentinel workspace using the Azure Monitoring agent (AMA). Having this data in Microsoft Sentinel helps you identify issues and security threats such as:\n- Trying to resolve malicious domain names.\n- Stale resource records.\n- Frequently queried domain names and talkative DNS clients.\n- Attacks performed on DNS server.\n\nYou can get the following insights into your Windows DNS servers from Microsoft Sentinel:\n- All logs centralized in a single place.\n- Request load on DNS servers.\n- Dynamic DNS registration failures.\n\nWindows DNS events are supported by Advanced SIEM Information Model (ASIM) and stream data into the ASimDnsActivityLogs table. [Learn more](https://docs.microsoft.com/azure/sentinel/normalization).\n\nFor more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2225993&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ASimDnsActivityLogs",
            "baseQuery": "ASimDnsActivityLogs\n| where EventProduct == \"DNS Server\"| where EventVendor == \"Microsoft\""
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "ASimDnsActivityLogs\n| where EventProduct == \"DNS Server\"\n            | sort by TimeGenerated"
        },
        {
            "description": "Count the number of failed DNS queries for each source IP address and failure type query.",
            "query": "ASimDnsActivityLogs\n| where EventProduct == \"DNS Server\"\n            | where EventType == \"Query\" and EventResult == \"Failure\"\n| summarize count() by SrcIpAddr, EventResultDetails"
        },
        {
            "description": "Count the number of queries that return NXDOMAIN, indicating that the queries domain name does not exist, and compares the count to a threshold of 100.",
            "query": "ASimDnsActivityLogs\n| where EventProduct == \"DNS Server\"\n            | where EventResultDetails == \"NXDOMAIN\"\n| summarize c=count() by SrcIpAddr\n| where c > 100"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "ASimDnsActivityLogs",
            "value": null
        }
    ],
    "dataTypes": [
        {
            "name": "ASimDnsActivityLogs",
            "lastDataReceivedQuery": "ASimDnsActivityLogs\n| where EventProduct == \"DNS Server\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false,
        "featureFlag": {
            "feature": "ASimDnsActivityLogs",
            "featureStates": {
                "1": 2,
                "2": 2,
                "3": 2,
                "4": 2
            }
        }
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces/datasources",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace data sources",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true
                }
            }
        ],
        "customs": [
            {
                "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
            }
        ]
    },
    "instructionSteps": [
        {
            "instructions": [
                {
                    "type": "ASimDnsActivityLogs"
                }
            ]
        }
    ]
}