Hi all, I'm looking for the best method to collect DNS logs and specifically the DNS queries and answers logs. I see there is a preliminary set up in named.conf to enable the logs of the queries an where to write them as: options { querylog yes; } and logging { channel querylog { file "/var/log/dns.log"; severity debug 3; }; }; Does this  the logs will be in dns.log file , and now what is the best method to ingest them into SPLUNK with the right format mapping?  What is your experiences with Linux DNS service? I'm collect events with Splunk Deployment server + Heavy Forwarder  -->Splunk  ES CLOUD . Thank you. R   ... View more

Hello, I need to ingest Cynet XDR audit and alert events into Splunk Cloud solution but can not find a procedure docs. Neither in Cynet nor in Splunk. Does someone know the how-to or point me to a starting point? Thank you   ... View more