View and monitor threat logs

DNS Armor generates threat logs when suspicious or malicious activity is detected. You can use Cloud Logging to view and analyze the threat logs and gain actionable insight. Additionally, when you have a DNS threat detector monitoring your VPC network, the detector exports metrics that can be examined with Cloud Monitoring metrics.

Two metrics are available:

• networksecurity.googleapis.com/dnsthreatdetector/sent_dns_log_count: Count of logs that are sent to your provider for inspection.
• networksecurity.googleapis.com/dnsthreatdetector/received_dns_threat_count: The number of threat logs detected. This metric includes severity and the type of threat.

These metrics contain filters that let you analyze information more effectively such as filtering for logs generated by a specific DNS Armor instance through its threat detector ID or location.

Before you begin

Verify that the following have been completed before you view DNS threat logs:

• Enable the Network Security API in your project.
• Verify that you have the DNS Threat Detector Viewer role.

Threat logs are written to Cloud Logging and can result in additional storage costs. See Use logging and monitoring: Pricing or Pricing for Google Cloud Observability: Cloud Logging.

Permissions required for this task

To perform this task, you must have been granted the following permissions or the following IAM roles.

Permissions

• resourcemanager.projects.get
• resourcemanager.projects.list
• networksecurity.dnsThreatDetectors.get
• networksecurity.dnsThreatDetectors.list

Roles

• roles/networksecurity.dnsThreatDetectorViewer
• roles/logging.viewer

View threat logs

You can view logs in the Google Cloud console.

Each log entry includes details to identify the corresponding DNS query and threat.

Threat log record fields

Every threat log has the following fields.

Name	Type	Description
detectionTime	string	Time when the threat is detected in UTC. The timestamp is in ISO 8601 format.
dnsQuery	DnsLog	Cloud DNS Log format.
partnerId	string	Unique partner identifier.
threatInfo	threatInfo	The details of threat detected.

Threat info field

The following table describes the format of the threatInfo field.

Name	Type	Description
threatID	string	Unique threat identifier.
threat	string	The name of the threat detected.
threatDescription	string	A detailed description of the threat detected.
category	string	The subtype of the threat detected.
type	string	The type of the threat detected. For example, DNS_Tunnel, DGA (Domain Generation Algorithms), or C2 (Command and Control).
severity	string	The severity, (High, Medium, Low, or Info), associated with the threat detected. For more information, see Infoblox's Severity Level Definition.
confidence	string	Confidence of the threat prediction (high, medium, low). For more information, see Infoblox's Confidence Level Definition.
threatFeed	string	Threat feed that triggered this threat alert.
indicatorType	string	The type of indicator that triggered this threat alert. For example, URL, IP, Hash, or Host.
threatIndicator	string	The threat indicator that triggered this alert.

DNS Query field

The following table describes the format of the DnsQuery field.

Name	Type	Description
projectNumber	string	Source project number.
location	string	Google Cloud region, for example us-east1, from which the response was served.
queryName	string	DNS query name, RFC 1035 4.1.2.
queryType