Collect ExtraHop Reveal(x) DNS logs

This document explains how to ingest ExtraHop Reveal(x) DNS logs to Google Security Operations using Bindplane. ExtraHop Reveal(x) provides passive DNS monitoring capabilities that capture and analyze all DNS transactions across the network. Organizations use Reveal(x) to detect DNS-based threats such as tunneling, domain generation algorithms (DGA), and data exfiltration through deep packet inspection of DNS traffic.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance.
• Windows Server 2016 or later, or a Linux host with systemd .
• If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements.
• Privileged access to the ExtraHop Reveal(x) Administration page.
• Network connectivity between the ExtraHop sensor and the Bindplane agent host on the configured syslog port.

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File.
4. Save the file securely on the system where Bindplane will be installed.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer IDfrom the Organization Detailssection.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

1. Open Command Promptor PowerShellas an administrator.

2. Run the following command:

     msiexec 
     
    / 
    i 
     
    "[https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi](https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi)" 
     
    / 
    quiet 
    
   

Linux installation

1. Open a terminal with rootor sudoprivileges.

2. Run the following command:

    sudo  
   sh  
   -c  
    " 
    $( 
   curl  
   -fsSlL  
    [ 
   https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ]( 
   https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
    )" 
     
   install_unix.sh 
   

Additional installation resources

For additional installation options, see the Bindplane agent installation guide .

Configure the Bindplane agent to ingest syslog and send to Google SecOps

1. Access the configuration file:

   • Linux: sudo systemctl status observiq-otel-collector
   • Windows: C:\Program Files\observIQ OpenTelemetry Collector\config.yaml

2. Edit the config.yaml file as follows:

     receivers 
    : 
     
    udplog 
    : 
     
    listen_address 
    : 
     
    "0.0.0.0:514" 
    exporters 
    : 
     
    chronicle/extrahop_dns 
    : 
     
    compression 
    : 
     
    gzip 
     
    creds_file_path 
    : 
     
    '/path/to/ingestion-authentication-file.json' 
     
    customer_id 
    : 
     
    '<CUSTOMER_ID>' 
     
    endpoint 
    : 
     
    '<ENDPOINT>' 
     
    log_type 
    : 
     
    'EXTRAHOP_DNS' 
     
    raw_log_field 
    : 
     
    body 
     
    ingestion_labels 
    : 
    service 
    : 
     
    pipelines 
    : 
     
    logs/extrahop_dns_to_chronicle 
    : 
     
    receivers 
    : 
     
    - 
     
    udplog 
     
    exporters 
    : 
     
    - 
     
    chronicle/extrahop_dns 
    
   

• Replace <CUSTOMER_ID> with the actual customer ID.
• Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved.
• Replace <ENDPOINT> with your regional endpoint:
  • United States: malachiteingestion-pa.googleapis.com
  • Europe: europe-malachiteingestion-pa.googleapis.com
  • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com

Restart the Bindplane agent to apply the changes

• To restart the Bindplane agent in Linux, run: sudo systemctl restart observiq-otel-collector
• To restart the Bindplane agent in Windows, use the Servicesconsole or run: cmd net stop observiq-otel-collector && net start observiq-otel-collector

Configure ExtraHop Reveal(x) Open Data Stream for DNS syslog forwarding

Add a syslog Open Data Stream target

1. Sign in to the ExtraHop Administrationpage.
2. In the System Configurationsection, click Open Data Streams.
3. Click Add Targetand select Syslog.
4. Provide the following configuration details:
   • Name: Enter a descriptive name (e.g., Google SecOps-DNS ).
   • Host: Enter the IP address of the Bindplane agenthost.
   • Port: 514 .
   • Protocol: UDP.
5. Click Testto verify connectivity, then click Save.

Create a trigger to export DNS transactions

1. Click the System Settingsicon and select Triggers.
2. Click Create.
3. Provide the following configuration details:
   • Name: DNS Syslog Export .
   • Events: Select DNS_REQUESTand DNS_RESPONSE.

4. In the Editorpane, enter the following trigger script:

     var 
     
    obj 
     
    = 
     
    { 
     
    eh_event 
    : 
     
    "dns" 
    , 
     
    client_ip 
    : 
     
    Flow 
    . 
    client 
    . 
    ipaddr 
    . 
    toString 
    (), 
     
    server_ip 
    : 
     
    Flow 
    . 
    server 
    . 
    ipaddr 
    . 
    toString 
    (), 
     
    client_port 
    : 
     
    Flow 
    . 
    client 
    . 
    port 
    , 
     
    server_port 
    : 
     
    Flow 
    . 
    server 
    . 
    port 
    , 
     
    qname 
    : 
     
    DNS 
    . 
    qname 
    , 
     
    qtype 
    : 
     
    DNS 
    . 
    qtype 
    }; 
    if 
     
    ( 
    event 
     
    === 
     
    "DNS_RESPONSE" 
    ) 
     
    { 
     
    obj 
    . 
    dns_type 
     
    = 
     
    "response" 
    ; 
     
    obj 
    . 
    rcode 
     
    = 
     
    DNS 
    . 
    errorNum 
    ; 
     
    obj 
    . 
    answers 
     
    = 
     
    JSON 
    . 
    stringify 
    ( 
    DNS 
    . 
    answers 
    ); 
    } 
     
    else 
     
    { 
     
    obj 
    . 
    dns_type 
     
    = 
     
    "request" 
    ; 
     
    obj 
    . 
    opcode 
     
    = 
     
    DNS 
    . 
    opcode 
    ; 
    } 
    Remote 
    . 
    Syslog 
    ( 
    "Chronicle-DNS" 
    ). 
    info 
    ( 
    JSON 
    . 
    stringify 
    ( 
    obj 
    )); 
    
   

5. Click Save.

Assign the trigger to devices

1. Open the trigger you created.
2. In the Assignmentssection, click Assign.
3. Select the relevant devices or device groups and click Assign.

UDM mapping table

Log Field	UDM Mapping	Logic
answers	network.dns.answers	Parsed from raw field.
dst	target.ip	Raw mapping.
dpt	target.port	Raw mapping.
host	principal.hostname	Raw mapping.
proto	network.ip_protocol	Raw mapping.
qname	network.dns.questions.name	Raw mapping.
qtype	network.dns.questions.type	Raw mapping.
rcode	network.dns.response_code	Raw mapping.
src	principal.ip	Raw mapping.
spt	principal.port	Raw mapping.
ttl	network.dns.answers.ttl	Raw mapping.
N/A	metadata.log_type	Set to EXTRAHOP_DNS .
N/A	metadata.product_name	Set to Reveal(x) DNS .
N/A	metadata.vendor_name	Set to ExtraHop .

Need more help? Get answers from Community members and Google SecOps professionals.