DnsAuditEvents

DNS server audit events enable change tracking on the DNS server. An audit event is logged each time server, zone, or resource record settings are changed. This includes operational events such as zone transfers, and DNSSEC zone signing and unsigning. This table captures audit events that are not from dynamic updates.

Table attributes

Attribute	Value
Resource types	microsoft.securityinsights/securityinsights
Categories	Security
Solutions	SecurityInsights
Basic log	No
Ingestion-time transformation	No
Sample Queries	-

Columns

Column	Type	Description
Action	string	If a query meets the criteria of a policy, the action is the response that the policy requires.
ActiveKey	string	Signing key of the KSK's active key.
AdditionalData	dynamic	Additional information not already scoped into its own dedicated field.
Base64Data	string	Key data.
_BilledSize	real	The record size in bytes
BufferSize	int	Size of the buffer used for logging the event data.(in bytes)
ChildZone	string	Name of a child zone.
ClientSubnetList	string	The list of IPv4 and IPv6 of the client subnet.
ClientSubnetRecord	string	Then name of the client subnet.
Condition	string	Specific circumstances or requirements that trigger certain actions or policies.
Criteria	string	Criteria or conditions that triggered the event.
CryptoAlgorithm	string	The cryptographic algorithm used for securing DNS-related operations.
CurrentRolloverStatus	string	The state of the key rollover process from one key to another.
CurrentState	string	The current status of a DNS key or zone.
DenialOfExistence	string	The method used to prove that a certain DNS record does not exist.
Digest	string	A secure fingerprint, allowing DNS resolvers to validate the authenticity of the trust anchor information.
DigestType	string	Specifies the type of cryptographic hash algorithm used for generating the digest (hash) value.
DistributeTrustAnchor	string	Relates to the distribution of a trust anchor for DNSSEC, which is a secure public key that helps in the validation of DNS data.
DnsKeyRecordSetTtl	int	The time-to-live (TTL) value assigned to DNSKEY records when signing a DNS zone. This value determines how long a DNSKEY record will be considered valid before it needs to be refreshed.
DnsKeySignatureValidityPeriod	int	The duration in seconds that a DNSKEY record’s signature is considered valid.
DnsQuery	string	The domain that needs to be resolved.
DnsQueryType	int	The DNS resource record type codes as defined by the Internet Assigned Numbers Authority (IANA).
DSRecordGenerationAlgorithm	string	The algorithm used to generate the Delegation Signer (DS) record from the DNSKEY record.
DSRecordSetTtl	int	The time-to-live (TTL) value for the DS (Delegation Signer) record set.
DSSignatureValidityPeriod	int	The period in seconds that a DS (Delegation Signer) record’s signature is considered valid.
EnableRfc5011KeyRollover	string	The process of automating the update and rollover of DNSSEC keys in accordance with RFC 5011 standards.
EventGuid	string	Unique identifier for the specific event.
EventId	string	Identifier for the underlying Windows event.
EventString	string	Human-readable description of the event.
EventType	string	Type of DNS event (e.g., zone transfer, dynamic update, DNSSEC signing).
FilePath	string	The location of a file or directory that the DNS server is interacting with.
Forwarders	string	DNS forwarders used by the server.
InitialRolloverOffset	int	The initial time delay (in seconds) before the first rollover action is triggered for a DNSSEC key.
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
IsEnabled	string	This parameter indicates whether the policy or exception list is currently active.
IsKeyMasterServer	string	Whether the DNS server is the key master server for a DNSSEC-signed zone.
KeyId	string	The unique identifier of a DNSSEC signing key.
KeyLength	int	The length of the cryptographic key used in DNSSEC signing operations.
KeyMasterServer	string	The DNS server that is responsible for generating and managing the DNSSEC keys for a zone.
KeyOrZone	string	The signing key used for authentication and data integrity in a specific DNS zone.
KeyProtocol	string	Protocol used for DNSSEC key management (e.g., DNSKEY, DS).
KeyStorageProvider	string	The system or service that is responsible for securely storing the DNSSEC keys.
KeyTag	int	A numeric identifier for the cryptographic key used by the DS record.
KeyType	string	The type of DNSSEC signing key being used.
KskOrZsk	string	The type of signing key used in a specific DNS zone.
LastRolloverTime	datetime	The last time a rollover process took place.
ListenAddresses	string	IP addresses on which the DNS server listens.
LookupValue	string	Type of DNS lookup (e.g., recursive, iterative).
MasterServer	string	The primary DNS server from which a secondary DNS server obtains zone data.
Name	string	Specifies the domain name or hostname associated with a specific record.
NameServer	string	Name server responsible for the DNS event.
NewPropertyValues	string	The set of properties after they were updated for a specific policy or exception list in the DNS server or zone.
NewValue	string	The updated value assigned to a specific property key within the DNS zone.
NextKey	string	The upcoming key that will be used in the DNS zone signing process after the current active and standby keys.
NextRolloverAction	string	The rollover action performed.
NextRolloverTime	datetime	The next time a rollover process should happen.
NodeName	string	The node name within the DNS zone.
NSec3HashAlgorithm	int	The cryptographic hash algorithm used in the NSEC3 protocol for DNSSEC.
NSec3Iterations	int	The number of additional hashing iterations a DNSSEC-enabled DNS server uses.
NSec3OptOut	string	Indicates if the DNSSEC NSEC3 protocol is configured to allow unsigned delegations.
NSec3RandomSaltLength	int	The length of the random salt value used in the NSEC3 protocol for DNSSEC.
NSec3UserSalt	string	The user-defined salt value used in the NSEC3 protocol for DNSSEC.
OldPropertyValues	string	The set of properties before they were updated for a specific policy or exception list in the DNS server or zone.
ParentHasSecureDelegation	string	Whether the parent zone has a secure delegation to the child zone.
Policy	string	Defines rules or guidelines for managing specific aspects of DNS behavior.
ProcessingOrder	int	Determines the sequence in which policies are applied.
PropagationTime	int	Time taken for the event information to propagate. Duration (e.g., milliseconds) or “Immediate” if no delay.
PropertyKey	string	Specific property or setting affected by the event.
RDATA	string	Represents the data of the resource record that was created, deleted, or scavenged in the DNS zone.
RecursionScope	string	A specific area or set of conditions under which DNS recursion is allowed or applied on a DNS server.
ReplicationScope	string	Scope of DNS replication (e.g., forest-wide, domain-specific).
_ResourceId	string	A unique identifier for the resource that the record is associated with
RolloverPeriod	int	Time interval for log rollover (e.g., daily, weekly).
RolloverType	string	Type of rollover (e.g., overwrite, append).
ScavengeServers	string	Servers involved in DNS scavenging (aging and cleanup of stale records).
Scope	string	The scope of the event (e.g., server-wide, zone-specific).
Scopes	string	DNS scopes impacted by the event (e.g., global, local).
SecureDelegationPollingPeriod	int	Interval for polling secure delegation information. Numeric value (e.g., minutes) or “Disabled” if not applicable.
SeizedOrTransferred	string	Refers to the action taken, either a seizure (when control is forcibly transferred) or a voluntary transfer of the key master role.
ServerName	string	Represents the DNS server where the policy or exception list is being configured.
Setting	string	Specific DNS configuration setting modified by the event.
SignatureInceptionOffset	int	Offset time for DNSSEC signature inception. Duration (e.g., seconds) or “Immediate” if no delay.
Source	string	Source of the DNS event (e.g., server, client).
SourceSystem	string	The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
StandbyKey	string	the backup key that will be used if the current active key is compromised or needs to be replaced in the DNS zone signing process.
StoreKeysInAD	string	Specifies whether the keys are stored in Active Directory Domain Services (AD DS). This setting applies only to Active Directory-integrated zones when the vendor of KeyStorageProvider is Microsoft.
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
SubTreeAging	string	Mechanism that affects the aging (expiration) of DNS records within a specific subtree or branch of a DNS zone.
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The timestamp (UTC) of when the event was generated.
TTL	int	The time-to-live for the DNS record, indicating how long the record should be cached before it is discarded or refreshed.
Type	string	The name of the table
VirtualizationID	string	A unique key to manage and coordinate activities within the virtualized environment.
WithNewKeys	string	Indicates whether new DNSSEC keys were generated.
WithWithout	string	Whether key signing key (KSK) metadata is included or excluded when exporting DNSSEC settings for a specific zone.
Zone	string	The zone related to the activity.
ZoneFile	string	The name of the zone file.
ZoneName	string	The name of a DNS zone on which the zone which the event relates to.
ZoneScope	string	A list of scopes and weights for the zone.
ZoneSignatureValidityPeriod	int	The amount of time that signatures that cover all other record sets are valid.