IP address to hostname or FQDN

Elastic Security
1

Hi,

I'm new to Elastic Security.

Network events are logged with destination IP address. Is there any way it can be translated to hostname/FQDN.?

Is there any setting can be done for DNS resolution.?

I'm currently running trial instance in GCP.

--
Thanks & Regards

2

Don't believe there's a way to do it in elastic or in a pipeline currently, this is something you would want to do in Logstash - Dns filter plugin | Logstash Reference [7.13] | Elastic

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.