Device Integration: Windows AD and DNS

TABLE OF CONTENTS

• Overview
• Prerequisites
• Enabling Audit & DNS Logs
  • Enable Windows / AD Audit Logs
  • Enable DNS Diagnostic Logging
• NxLog Configuration for AD and DNS
  • File Location
  • Sample Configuration
• Apply and Restart NxLog
• Verification (MSSP Only)
  • On ADR CCE
  • On ADR GUI

Overview

This article explains how to enable and forward Active Directory (AD) audit logs and DNS diagnostic logs from a Windows server to ADR CCE using NxLog. Once configured, ADR ingests, normalises, and analyses these logs for visibility into user activity, authentication events, and DNS activity.

Prerequisites

• Admin access to the Windows server running AD and DNS roles.

• Outbound connectivity from Windows server → ADR CCE on:

  • UDP 514 (DNS logs)

  • UDP 5154 (AD audit logs)

• Installed NxLog Community Edition (download link).

• DNS diagnostic logging enabled (see Section 3.2).

Enabling Audit & DNS Logs

Enable Windows / AD Audit Logs

Follow ADR KB instructions:

Enabling Windows Security Events using Audit Policy

Enable DNS Diagnostic Logging

1. Log in to the Windows server.

2. Open DNS Manager → Right-click the DNS server → Properties.

3. Go to the Debug Logging tab.

4. Enable logging for queries, transfers, updates, and errors as required.

By default, DNS logs are stored in:

C:\Windows\System32\dns\dns.log
or
C:\Windows\Sysnative\dns\dns.log (on 64-bit systems).

NxLog Configuration for AD and DNS

File Location

C:\Program Files\nxlog\conf\nxlog.conf

Sample Configuration

Replace file content with the following (update <CCE_IP> with your ADR CCE IP):

###############################################
# NxLog configuration for AD + DNS logs
###############################################

define ROOT C:\Program Files\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _json>
  Module xm_json
</Extension>

<Extension syslog>
  Module xm_syslog
</Extension>

################################################
# Active Directory / Windows Security Audit Logs
################################################
define aisiem \
2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17, 18, 19, 20, 21, 41, 104, 500, \
520, 600, 1001, 1006, 1007, 1008, 1015, 1033, 1034, 1074, 1102, 1116, 1117, 1118, \
1119, 1125, 2003, 2100, 4103, 4104, 4608, 4609, 4616, 4618, 4624, 4625, 4634, 4647, \
4648, 4649, 4656, 4657, 4659, 4660, 4661, 4662, 4663, 4670, 4672, 4673, 4674, 4685, \
4688, 4690, 4697, 4698, 4699, 4700, 4702, 4703, 4704, 4705, 4707, 4717, 4718, 4719, \
4720, 4722, 4723, 4724, 4725, 4726, 4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, \
4735, 4737, 4738, 4739, 4740, 4741, 4742, 4743, 4744, 4745, 4746, 4747, 4748, 4749, \
4750, 4751, 4752, 4753, 4754, 4755, 4756, 4757, 4758, 4759, 4760, 4761, 4762, 4763, \
4764, 4765, 4767, 4769, 4771, 4772, 4776, 4777, 4778, 4779, 4780, 4781, 4782, 4783, \
4784, 4785, 4786, 4787, 4788, 4789, 4790, 4791, 4794, 4797, 4798, 4799, 4800, 4801, \
4802, 4803, 4946, 4947, 4950, 4954, 4964, 4985, 5001, 5004, 5007, 5010, 5012, 5025, \
5031, 5136, 5137, 5140, 5141, 5142, 5143, 5144, 5145, 5152, 5153, 5155, 5157, 5376, \
5377, 5447, 5712, 6005, 6006, 6008, 7034, 7035, 7036, 7040, 7045, 8003, 8004, 8007, \
11707, 11708, 23010, 23050, 23090, 34112, 34113, 64004 \

<Input in_ad>
    Module im_msvistalog
    Query <QueryList>\
              <Query Id="0">\
                   <Select Path="Security">* </Select>\
                   <Select Path="Application">* </Select>\
                   <Select Path="System">* </Select>\
              </Query>\
          </QueryList>
</Input>

<Output out_ad>
    Module om_udp
    Host <CCE_IP>
    Port 5154
    Exec to_json();
</Output>

<Route ad_route>
    Path in_ad => out_ad
</Route>

################################################
# DNS Logs
################################################
<Input DNS_In>
    Module im_file
    File "C:\\Windows\\Sysnative\\dns\\dns*"
    SavePos TRUE
    InputType LineBased
    Exec if $raw_event =~ /^#/ drop();
    Exec $Message = $raw_event;
</Input>

<Output DNS_Out>
    Module om_udp
    Host <CCE_IP>
    Port 514
    Exec $SyslogFacilityValue = 2;
    Exec $SourceName = 'windows_dns_logs';
    Exec to_syslog_bsd();
</Output>

<Route dns_route>
    Path DNS_In => DNS_Out
</Route>

Apply and Restart NxLog

1. Save the updated nxlog.conf.

2. Restart the NxLog service:

   net stop nxlog 
   net start nxlog

3. Generate test activity:

   • AD: User login/logout events.

   • DNS: Perform queries (nslookup, dig, etc.) against the DNS server.

Verification (MSSP Only)

On ADR CCE

Execute the following command:

For Windows AD

sudo tcpdump -i any port 5154 and host <IP Address> -s0 -AAA

For Windows DNS

sudo tcpdump -i any port 514 and host <IP Address> -s0 -AAA

Confirm logs from the server are being received.

On ADR GUI

1. Log in to aiSIEM.

2. Navigate: System → Logs and Flows Collection Status.

3. Verify the Windows server’s IP is listed, and both AD and DNS logs are visible.