Cyclic DNS Requests
1) You log DNS requests
2) The DNS logs that you recieve contain the requested URL but not the IP address that this URL resolves to
3) You configure a connector to have name resolution enabled
4) You configure that connector to query the same DNS server that you are logging from step 1
Could this cause a cyclic DNS request (i.e. a 'legitimate' DNS request from a client that causes a DNS request from the connector that in turn causes a DNS request from the connector that.... etc)?
If so, how do you deal with this?
1) Attempt to change step 2 so that the response IP address is logged at the time of the initial event generation?
2) Configure the connectors not do to name resolution?
3) Configure the connectors to use a different DNS server, which only responds to the connectors and isn't logged.
or some other way?
I'm interested in all opinions, especially if you've had to deal with something similar....
Re: Cyclic DNS Requests
If a field comes in as a hostname or DNS name and there is not an IP the
default behavior of the connector is to do name resolution. Yes it will
potentially hit the same DNS resolver but DNS resolvers will have a cached
entry for that IP address already.
My recommendation is evaluating the use case behind why you want DNS
logging and if you need the associated IP address (might not be necessary).
If you do determine you want the IP it is better to populate that from the
event itself instead of relying on the connector to do a DNS resolution for
#1 Yes disable IP resolution on the connector if the connector is only
accepting DNS events.
#2 Configure the connector to ignore or filter all events from your DNS
server that contain no IP. Only import the DNS resolver "Replies" which
should have an IP and Domain in one event.
#3 Also filter out DNS requests from IP's belonging to your connector
environment and any other ArcSight device for that matter. Your use-case
should only be concerned with DNS traffic from users (i'm assuming).
So to summarize you can achieve all that you want by making some simple
filter and applying it to your connector, you can do this by double
clicking the connector in ESM and accessing the Conditions tab.