Hello,
Is there a proper way to link address from conn.log with host names from dns.log? There is no distinctive ‘key’ to link both logs for an unique connection.
Following way hopefully works, and any robust script or code to use? Thank you.
"
While Zeek’s dns.log closely tracks address-name associations, other logs do not repeat this information. Manually establishing the cross-log linkage can prove tedious since offline resolution of those names generally does not provide accurate results. Instead, one needs to identify historic name lookups that temporally most closely preceded TCP/IP flows to/from resulting IP addresses. " from Log Enrichment With DNS Host Names | Corelight