:orphan: Document not referenced in a toctree, so add this. DNS EVE Logging Changes for 8.0 =============================== Suricata 8.0 modifies the DNS logging in ``dns`` and ``alert`` records to a version ``3`` logging format. These changes address a lack of fidelity in alerts for DNS responses, as well as unify the format of the ``dns`` object accross ``dns`` and ``alert`` objects. Ticket: https://redmine.openinfosecfoundation.org/issues/6281 The changes are summarized below: * DNS requests now have a type of ``request`` instead of ``query``. * DNS responses now have a type of ``response`` instead of ``answer``. * DNS requests will now log the queries in an array instead of logging multiple request events in the case where the request contained multiple queries. This was already done for DNS requests logged as part of an ``alert``. .. list-table:: :widths: 50 50 :header-rows: 1 * - 7.0 - 8.0 * - .. code-block:: { "event_type": "dns", "dns": { "type": "query", "id": 0, "rrname": "www.suricata.io", "rrtype": "A", "tx_id": 0, "opcode": 0 } } - .. code-block:: { "event_type": "dns", "dns": { "version": 3, "type": "request", "tx_id": 0, "id": 0, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [ { "rrname": "www.suricata.io", "rrtype": "A" } ] } } * DNS responses now log the queries in a ``queries`` array instead of logging the first ``rrname`` and ``rrtype`` directly in the ``dns`` object. .. list-table:: :header-rows: 1 * - 7.0 - 8.0 * - .. code-block:: { "event_type": "dns", "dns": { "version": 2, "type": "answer", "id": 0, "flags": "8180", "qr": true, "rd": true, "ra": true, "opcode": 0, "rrname": "www.suricata.io", "rrtype": "A", "rcode": "NOERROR", "answers": [ { "rrname": "www.suricata.io", "rrtype": "CNAME", "ttl": 3597, "rdata": "suricata.io" }, { "rrname": "suricata.io", "rrtype": "A", "ttl": 597, "rdata": "35.212.0.44" } ] } } - .. code-block:: { "event_type": "dns", "dns": { "version": 3, "type": "response", "tx_id": 1, "id": 0, "flags": "8180", "qr": true, "rd": true, "ra": true, "opcode": 0, "rcode": "NOERROR", "queries": [ { "rrname": "www.suricata.io", "rrtype": "A" } ], "answers": [ { "rrname": "www.suricata.io", "rrtype": "CNAME", "ttl": 3597, "rdata": "suricata.io" }, { "rrname": "suricata.io", "rrtype": "A", "ttl": 597, "rdata": "35.212.0.44" } ], } } * DNS requests logged in an alert object will now log the ``answers`` as an array. See above 8.0 example for the format. The ``dns`` object is now consistent across DNS requests and responses, as well as in ``alerts``. * Example of alert on DNS request .. list-table:: :header-rows: 1 * - 7.0 - 8.0 * - .. code-block:: { "event_type": "alert", "dns": { "query": [ { "type": "query", "id": 0, "rrname": "www.suricata.io", "rrtype": "A", "tx_id": 0, "opcode": 0 } ] } } - .. code-block:: { "event_type": "alert", "dns": { "version": 3, "type": "request", "tx_id": 0, "id": 0, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [ { "rrname": "www.suricata.io", "rrtype": "A" } ] }, } * Example of alert on DNS response .. list-table:: :header-rows: 1 * - 7.0 - 8.0 * - .. code-block:: { "event_type": "alert", "dns": { "answer": { "version": 2, "type": "answer", "id": 0, "flags": "8180", "qr": true, "rd": true, "ra": true, "opcode": 0, "rrname": "www.suricata.io", "rrtype": "A", "rcode": "NOERROR" } } } - .. code-block:: { "event_type": "alert", "dns": { "version": 3, "type": "response", "tx_id": 1, "id": 0, "flags": "8180", "qr": true, "rd": true, "ra": true, "opcode": 0, "rcode": "NOERROR", "queries": [ { "rrname": "www.suricata.io", "rrtype": "A" ], "answers": [ { "rrname": "www.suricata.io", "rrtype": "CNAME", "ttl": 3597, "rdata": "suricata.io" }, { "rrname": "suricata.io", "rrtype": "A", "ttl": 597, "rdata": "35.212.0.44" } ] }, }