Protective DNS Log Push Training Video

Why It Matters

Real‑time DNS log streaming empowers security operations with immediate visibility, reducing manual extraction effort and enhancing threat detection capabilities.

Key Takeaways

• One-time account upgrade required for DNS log push activation.
• Supports up to four direct pushes to AWS S3 or Splunk.
• Logs delivered in under a minute, batches of 100,000 records.
• No source set or policy metadata; crosswalk needed post‑push.
• Ownership token verification mandatory for both S3 and Splunk setups.

Summary

The video walks users through configuring Protective DNS log push, emphasizing a one‑time account upgrade for organizations onboarded before April 2023. It outlines the feature’s capacity to create up to four direct pushes to either an AWS S3 bucket or a Splunk instance, delivering raw resolver logs in under a minute with files containing up to 100,000 records. Key insights include the absence of source‑set or policy metadata in the raw logs, requiring administrators to use the provided crosswalk tables to map IDs after ingestion. The process is automated, contrasting with scheduled extracts, and supports rapid, continuous log streaming. The tutorial details the UI navigation—selecting the Resolver Logs tab, reviewing the log‑push table, and using the Connect a Service button. For S3, users must supply job name, AWS access key, secret, bucket path, region, endpoint URL, and complete an ownership‑token verification. For Splunk, required fields include collector URL, channel ID, URL‑encoded auth token, source type, and a verification token, with similar enable‑and‑save steps. By enabling near‑real‑time DNS log delivery, security teams can integrate data directly into SIEMs or data lakes, accelerating threat detection and response. However, the need for internal IT coordination and post‑push metadata mapping adds operational overhead that organizations must plan for.

Original Description

CISA’s Protective Domain Name System (#ProtectiveDNS) service delivers greater protection, increased visibility, and enhanced capabilities for federal civilian executive branch agencies and select critical infrastructure partners in our mission to reduce cyber risk.

Watch our newest training video for the Protective DNS log push capability.

To learn more about Protective DNS, visit CISA.gov or contact [e-mail].