Requesting a bump in priority for this, if it hasn't been previously handled.

I would like to monitor DNS requests (to a Windows Server 2012 DNS server) and process them through CDB Malware Domain matching and Windows Server 2012 DNS requests are only logged using the .etl format.

Some Microsoft coding documentation regarding Event Trace Log format refers to the following functions (hope this helps!)

OpenTrace Function
TRACEHANDLE OpenTrace(
Inout PEVENT_TRACE_LOGFILE Logfile
);

ProcessTrace Function
ULONG ProcessTrace(
In PTRACEHANDLE HandleArray,
In ULONG HandleCount,
In LPFILETIME StartTime,
In LPFILETIME EndTime
);

CloseTrace Function
ULONG CloseTrace(
In TRACEHANDLE TraceHandle
);

On Thu, Oct 6, 2016 at 10:42 AM, drewbeebe notifications@github.com wrote:

Requesting a bump in priority for this, if it hasn't been previously handled.

You can submit a pull request on github: https://github.com/ossec/ossec-hids
So far no one has seemed very interested in the feature.

I would like to monitor DNS requests (to a Windows Server 2012 DNS server) and process them through CDB Malware Domain matching and Windows Server 2012 DNS requests are only logged using the .etl format.

Some Microsoft coding documentation regarding Event Trace Log format refers to the following functions (hope this helps!)

OpenTrace Function
TRACEHANDLE OpenTrace(
Inout PEVENT_TRACE_LOGFILE Logfile
);

ProcessTrace Function
ULONG ProcessTrace(
In PTRACEHANDLE HandleArray,
In ULONG HandleCount,
In LPFILETIME StartTime,
In LPFILETIME EndTime
);

CloseTrace Function
ULONG CloseTrace(
In TRACEHANDLE TraceHandle
);

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

@drewbeebe check out packetbeat from elastic, it can monitor Dns

Also looking to read ETL natively in ossec. Suspect it will get more popular as 2016 natively outputs DNS logs in this format, and 2012R2 does with a hotfix.

This may become more prevalent shortly as monitoring DNS has become a necessity for large environments. Proven data ex-filtration by DNS etc might speed this up.

Unfortunately there isn't a lot of interest in working on the Windows agent at the moment. We'd love for some volunteers to jump in though!

I'm not aware of any primers or anything, but you'd need to know a bit of C for the Windows platform.

You can read the existing event log and event channel code. Might be of some help getting an idea of what the work is like:

https://github.com/ossec/ossec-hids/blob/master/src/logcollector/read_win_event_channel.c
https://github.com/ossec/ossec-hids/blob/master/src/logcollector/read_win_el.c

I haven't downloaded it yet, but this looks promising:
https://msdn.microsoft.com/en-us/library/aa363805(v=vs.85).aspx