As part of the bachelor's thesis, the student will get acquainted with the issues of processing and security monitoring of DNS server logs. The student will get access to an anonymized dataset of logs collected from BIND servers operating the DNS service, connected to the Masaryk University network. In this dataset, the student first describes the features of the records that appear in the log. Then creates a Syslog-ng configuration that normalizes log events and transports them to the Elasticsearch-Logstash-Kibana (ELK) system. Finally, in cooperation with CSIRT-MU security staff, the student identifies features and metrics that should be monitored in the DNS server log considering the cybersecurity point of view of and creates visualization plugins for them within the Kibana dashboard.
The output of the work will be the configuration of all tools used for log processing and dashboard in Kibana, containing visualizations of features of interest.

The work procedure will consist of the following steps:

• Learn how to log in BIND DNS, Syslog-ng, and ELK
• Description of DNS log features
• Log normalization
• Identification of features of interest that may occur in DNS queries in the MU network
• Design visualizations for identified features in Kibana
• Implement proposed visualizations within the Kibana dashboard