DnsAuditEvents

DnsAuditEvents Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel DNS server audit events enable change tracking on the DNS server. An audit event is logged each time server, zone, or resource record settings are changed. This includes operational events such as zone transfers, and DNSSEC zone signing and unsigning. This table captures audit events that are not from dynamic updates.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
_ResourceId A unique identifier for the resource that the record is associated with String
_SubscriptionId A unique identifier for the subscription that the record is associated with String
Action If a query meets the criteria of a policy, the action is the response that the policy requires. String
ActiveKey Signing key of the KSK’s active key. String
AdditionalData Additional information not already scoped into its own dedicated field. Object
Base64Data Key data. String
BufferSize Size of the buffer used for logging the event data.(in bytes) Int32
ChildZone Name of a child zone. String
ClientSubnetList The list of IPv4 and IPv6 of the client subnet. String
ClientSubnetRecord Then name of the client subnet. String
Condition Specific circumstances or requirements that trigger certain actions or policies. String
Criteria Criteria or conditions that triggered the event. String
CryptoAlgorithm The cryptographic algorithm used for securing DNS-related operations. String
CurrentRolloverStatus The state of the key rollover process from one key to another. String
CurrentState The current status of a DNS key or zone. String
DenialOfExistence The method used to prove that a certain DNS record does not exist. String
Digest A secure fingerprint, allowing DNS resolvers to validate the authenticity of the trust anchor information. String
DigestType Specifies the type of cryptographic hash algorithm used for generating the digest (hash) value. String
DistributeTrustAnchor Relates to the distribution of a trust anchor for DNSSEC, which is a secure public key that helps in the validation of DNS data. String
DnsKeyRecordSetTtl The time-to-live (TTL) value assigned to DNSKEY records when signing a DNS zone. This value determines how long a DNSKEY record will be considered valid before it needs to be refreshed. Int32
DnsKeySignatureValidityPeriod The duration in seconds that a DNSKEY record’s signature is considered valid. Int32
DnsQuery The domain that needs to be resolved. String
DnsQueryType The DNS resource record type codes as defined by the Internet Assigned Numbers Authority (IANA). Int32
DSRecordGenerationAlgorithm The algorithm used to generate the Delegation Signer (DS) record from the DNSKEY record. String
DSRecordSetTtl The time-to-live (TTL) value for the DS (Delegation Signer) record set. Int32
DSSignatureValidityPeriod The period in seconds that a DS (Delegation Signer) record’s signature is considered valid. Int32
EnableRfc5011KeyRollover The process of automating the update and rollover of DNSSEC keys in accordance with RFC 5011 standards. String
EventGuid Unique identifier for the specific event. String
EventId Identifier for the underlying Windows event. String
EventString Human-readable description of the event. String
EventType Type of DNS event (e.g., zone transfer, dynamic update, DNSSEC signing). String
FilePath The location of a file or directory that the DNS server is interacting with. String
Forwarders DNS forwarders used by the server. String
InitialRolloverOffset The initial time delay (in seconds) before the first rollover action is triggered for a DNSSEC key. Int32
IsEnabled This parameter indicates whether the policy or exception list is currently active. String
IsKeyMasterServer Whether the DNS server is the key master server for a DNSSEC-signed zone. String
KeyId The unique identifier of a DNSSEC signing key. String
KeyLength The length of the cryptographic key used in DNSSEC signing operations. Int32
KeyMasterServer The DNS server that is responsible for generating and managing the DNSSEC keys for a zone. String
KeyOrZone The signing key used for authentication and data integrity in a specific DNS zone. String
KeyProtocol Protocol used for DNSSEC key management (e.g., DNSKEY, DS). String
KeyStorageProvider The system or service that is responsible for securely storing the DNSSEC keys. String
KeyTag A numeric identifier for the cryptographic key used by the DS record. Int32
KeyType The type of DNSSEC signing key being used. String
KskOrZsk The type of signing key used in a specific DNS zone. String
LastRolloverTime The last time a rollover process took place. DateTime
ListenAddresses IP addresses on which the DNS server listens. String
LookupValue Type of DNS lookup (e.g., recursive, iterative). String
MasterServer The primary DNS server from which a secondary DNS server obtains zone data. String
Name Specifies the domain name or hostname associated with a specific record. String
NameServer Name server responsible for the DNS event. String
NewPropertyValues The set of properties after they were updated for a specific policy or exception list in the DNS server or zone. String
NewValue The updated value assigned to a specific property key within the DNS zone. String
NextKey The upcoming key that will be used in the DNS zone signing process after the current active and standby keys. String
NextRolloverAction The rollover action performed. String
NextRolloverTime The next time a rollover process should happen. DateTime
NodeName The node name within the DNS zone. String
NSec3HashAlgorithm The cryptographic hash algorithm used in the NSEC3 protocol for DNSSEC. Int32
NSec3Iterations The number of additional hashing iterations a DNSSEC-enabled DNS server uses. Int32
NSec3OptOut Indicates if the DNSSEC NSEC3 protocol is configured to allow unsigned delegations. String
NSec3RandomSaltLength The length of the random salt value used in the NSEC3 protocol for DNSSEC. Int32
NSec3UserSalt The user-defined salt value used in the NSEC3 protocol for DNSSEC. String
OldPropertyValues The set of properties before they were updated for a specific policy or exception list in the DNS server or zone. String
ParentHasSecureDelegation Whether the parent zone has a secure delegation to the child zone. String
Policy Defines rules or guidelines for managing specific aspects of DNS behavior. String
ProcessingOrder Determines the sequence in which policies are applied. Int32
PropagationTime Time taken for the event information to propagate. Duration (e.g., milliseconds) or “Immediate” if no delay. Int32
PropertyKey Specific property or setting affected by the event. String
RDATA Represents the data of the resource record that was created, deleted, or scavenged in the DNS zone. String
RecursionScope A specific area or set of conditions under which DNS recursion is allowed or applied on a DNS server. String
ReplicationScope Scope of DNS replication (e.g., forest-wide, domain-specific). String
RolloverPeriod Time interval for log rollover (e.g., daily, weekly). Int32
RolloverType Type of rollover (e.g., overwrite, append). String
ScavengeServers Servers involved in DNS scavenging (aging and cleanup of stale records). String
Scope The scope of the event (e.g., server-wide, zone-specific). String
Scopes DNS scopes impacted by the event (e.g., global, local). String
SecureDelegationPollingPeriod Interval for polling secure delegation information. Numeric value (e.g., minutes) or “Disabled” if not applicable. Int32
SeizedOrTransferred Refers to the action taken, either a seizure (when control is forcibly transferred) or a voluntary transfer of the key master role. String
ServerName Represents the DNS server where the policy or exception list is being configured. String
Setting Specific DNS configuration setting modified by the event. String
SignatureInceptionOffset Offset time for DNSSEC signature inception. Duration (e.g., seconds) or “Immediate” if no delay. Int32
Source Source of the DNS event (e.g., server, client). String
SourceSystem String
StandbyKey the backup key that will be used if the current active key is compromised or needs to be replaced in the DNS zone signing process. String
StoreKeysInAD Specifies whether the keys are stored in Active Directory Domain Services (AD DS). This setting applies only to Active Directory-integrated zones when the vendor of KeyStorageProvider is Microsoft. String
SubTreeAging Mechanism that affects the aging (expiration) of DNS records within a specific subtree or branch of a DNS zone. String
TenantId String
TimeGenerated The timestamp (UTC) of when the event was generated. DateTime
TTL The time-to-live for the DNS record, indicating how long the record should be cached before it is discarded or refreshed. Int32
Type The name of the table String
VirtualizationID A unique key to manage and coordinate activities within the virtualized environment. String
WithNewKeys Indicates whether new DNSSEC keys were generated. String
WithWithout Whether key signing key (KSK) metadata is included or excluded when exporting DNSSEC settings for a specific zone. String
Zone The zone related to the activity. String
ZoneFile The name of the zone file. String
ZoneName The name of a DNS zone on which the zone which the event relates to. String
ZoneScope A list of scopes and weights for the zone. String
ZoneSignatureValidityPeriod The amount of time that signatures that cover all other record sets are valid. Int32

Schema changes #

Date Action
2024-10-18 Table added to tracking