[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nBefore you begin\n\nVerify that the following have been completed before you view DNS threat logs:\n\n- [Enable](https://console.cloud.google.com/apis/library/networksecurity.googleapis.com) the [Network Security API](/firewall/docs/reference/network-security/rest) in your project.\n- Verify that you have the `DNS Threat Detector Viewer` role.\n\nThreat logs are written to Cloud Logging and can result in additional\nstorage costs. See [Use logging and monitoring: Pricing](/dns/docs/monitoring#pricing)\nor [Pricing for Google Cloud Observability: Cloud Logging](/stackdriver/Pricing).\n\nPermissions required for this task\n\nTo perform this task, you must have been granted the following permissions\n*or* the following IAM roles.\n\n**Permissions**\n\n- `resourcemanager.projects.get`\n- `resourcemanager.projects.list`\n- `networksecurity.dnsThreatDetectors.get`\n- `networksecurity.dnsThreatDetectors.list`\n\n**Roles**\n\n- `roles/networksecurity.dnsThreatDetectorViewer`\n- `roles/logging.viewer`\n\nView threat logs\n\nYou can view logs in the Google Cloud console.\n\nEach log entry includes details to identify the corresponding DNS query and\nthreat. \n\nConsole\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/viewer?resource=dns_query)\n2. Filter the logs for `networksecurity.googleapis.com/DnsThreatDetector`.\n\nThreat log record fields\n\nEvery threat log has the following fields.\n\n| Name | Type | Description |\n|-----------------|------------|-------------------------------------------------------------------------------|\n| `detectionTime` | string | Time when the threat is detected in UTC. The timestamp is in ISO 8601 format. |\n| `dnsQuery` | DnsLog | Cloud DNS Log format. |\n| `partnerId` | string | Unique partner identifier. |\n| `threatInfo` | threatInfo | The details of threat detected. |\n\n\u003cbr /\u003e\n\nThreat info field\n\nThe following table describes the format of the `threatInfo` field.\n\n| Name | Type | Description |\n|---------------------|--------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `threatID` | string | Unique threat identifier. |\n| `threat` | string | The name of the threat detected. |\n| `threatDescription` | string | A detailed description of the threat detected. |\n| `category` | string | The subtype of the threat detected. |\n| `type` | string | The type of the threat detected. For example, DNS_Tunnel, DGA (Domain Generation Algorithms), or C2 (Command and Control). |\n| `severity` | string | The severity, (High, Medium, Low, or Info), associated with the threat detected. For more information, see Infoblox's [Severity Level Definition](https://docs.infoblox.com/space/BloxOneThreatDefense/1640103988/Severity+and+Confidence+Levels#Severity-Level-Definition) |\n| `confidence` | string | Confidence of the threat prediction (high, medium, low). For more information, see Infoblox's [Confidence Level Definition](https://docs.infoblox.com/space/BloxOneThreatDefense/1640103988/Severity+and+Confidence+Levels#Confidence-Level-Definition) |\n| `threatFeed` | string | Threat feed that triggered this threat alert. |\n| `indicatorType` | string | The type of indicator that triggered this threat alert. For example, URL, IP, Hash, or Host. |\n| `threatIndicator` | string | The threat indicator that triggered this alert. |\n\nDNS Query field\n\nThe following table describes the format of the `DnsQuery` field.\n\n| Name | Type | Description |\n|------------------------|--------|--------------------------------------------------------------------------------------------------------------------------------------------|\n| `projectNumber` | string | Source project number. |\n| `location` | string | Google Cloud region, for example `us-east1`, from which the response was served. |\n| `queryName` | string | DNS query name, [RFC 1035 4.1.2](https://datatracker.ietf.org/doc/html/rfc1035#section-4.1.2). |\n| `queryType` | string | DNS query type, [RFC 1035 4.1.2](https://datatracker.ietf.org/doc/html/rfc1035#section-4.1.2). |\n| `responseCode` | string | Response code, [RFC 1035 4.1.1](https://datatracker.ietf.org/doc/html/rfc1035#section-4.1.1). |\n| `rdata` | string | DNS answer in presentation format, [RFC 1035 5.1](https://datatracker.ietf.org/doc/html/rfc1035#section-5.1), truncated to 260 bytes. |\n| `authAnswer` | string | Authoritative answer, [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035). |\n| `sourceIp` | string | IP originating the query. |\n| `destinationIp` | string | Target IP address, only applicable for forwarding cases. |\n| `protocol` | string | `TCP` or `UDP`. |\n| `queryTime` | string | Timestamp for when the DNS query was sent. |\n| `vmInstanceId` | string | Compute Engine VM instance name, only applicable to queries initiated by Compute Engine VMs. |\n| `vmProjectNumber` | string | Google Cloud project ID of the network from which the query was sent, only applicable to queries initiated by Compute Engine VM instances. |\n| `serverlessInstanceId` | string | Serverless instance ID from which the query was sent, only applicable to queries initiated by Serverless. |\n\nWhat's next\n\n- Learn more about how to [Use logging and monitoring](/dns/docs/monitoring), including how to enable logging for your VPC networks.\n\n- Learn more about [Advanced threat detection](/dns/docs/threat-monitoring).\n\n- To find solutions for common issues that you might encounter when using\n threat monitoring, see [Troubleshooting](/dns/docs/troubleshooting#threat_monitoring).\n\n- To learn how to be alerted when a threat is detected, see [Alerting overview](/monitoring/alerts)."]]
