https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-windows-dns
shows Bindplane collecting DNS from the Windows Event channel Microsoft-Windows-DNSServer/Audit.
I enabled "Analytical and Debug Logs" and see queries and query results under Microsoft/Windows/DNS-Server/Analytical in Event Viewer. There are no query details in the Microsoft-Windows-DNSServer/Audit channel.
Two issues:
1) the google example collects from Audit, not Analytical where the queries and result are located.
2) this powershell does not list a Channel for Microsoft-Windows-DNSServer/Analytical,
Get-WinEvent -ListLog *
and when I try to read from Microsoft-Windows-DNSServer/Analytical (guessing the name) Bindplane does not not start, the error is that it cannot find the channel.
My questions:
Should I be able to use Bindplane to read the DNS queries and query results from the Analytical channel ?
I confirmed Bindplane can read the dns debug log file and I get WINDOWS_DNS. Is reading from the dns debug file the recommended procedure for collecting WINDOWS_DNS using Bindplane?