# SIEM can't detect DNS activity to Internet

**URL:** <https://discuss.elastic.co/t/siem-cant-detect-dns-activity-to-internet/236552>\
**Category:** SIEM\
**Created:** [June 10, 2020, 4:53pm UTC](https://discuss.elastic.co/t/siem-cant-detect-dns-activity-to-internet/236552 "2020-06-10T16:53:11Z")\
**Posts on this page:** 2\
**Page:** 2

<div class="post-metadata">

**Author:** ![Craig\_Chamberlain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_chamberlain/32/70079_2.png) [@Craig\_Chamberlain](https://discuss.elastic.co/u/Craig_Chamberlain)\
**Post date:** [June 17, 2020, 6:44pm UTC](https://discuss.elastic.co/t/siem-cant-detect-dns-activity-to-internet/236552/21 "2020-06-17T18:44:44Z")

</div>

So Discover searches are one option but you can also drag signals to the timeline (in the SIEM) in order to investigate signals like these. Once in the timeline, you can also search and sift data there. If you find the network connection events for the DNS port 53 traffic from Auditbeat or Winlogbeat they will contain details of the process which made the calls and sent the packets. You'd need Sysmon event 2, "Network Connect", from Windows hosts, or an equivalent event.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2020, 6:44pm UTC](https://discuss.elastic.co/t/siem-cant-detect-dns-activity-to-internet/236552/22 "2020-07-15T18:44:45Z")

</div>

Closed on July 15, 2020, 6:44pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/siem-cant-detect-dns-activity-to-internet/236552.md?page=1)