Overview

Control D can stream DNS query logs directly to a Sekoia.io intake over HTTPS. The managed integration sends JSON Lines to Sekoia.io and uses the Control D DNS intake format to map each event into normalized DNS, network, source, organization, and Control D action fields.

You do not need to deploy a public log receiver, Fluent Bit container, or Sekoia.io connector. Control D manages the outbound connection.

🚧

Availability

Sekoia.io streaming is currently available to select Control D Organization customers. The integration currently supports Sekoia.io workspaces in the FRA1 region only.

Before You Start

You need:

• A Control D Organization account approved for SIEM log streaming
• Full Analytics enabled on every Endpoint whose DNS queries should be streamed
• The IDs of the Organization and any Sub-Organizations to include
• The Organization's Analytics Storage Region
• Permission to create an intake in a Sekoia.io FRA1 workspace

Enabling Full Analytics causes Control D to process and store detailed DNS query data as described in Analytics Levels. Enable it only for the Endpoints whose logs you intend to stream.

Create the Sekoia.io Intake

1. Sign in to Sekoia.io and open the Intakes page.
2. Select + New Intake.
3. Search for and select Control D DNS.
4. Enter a Name, associate the intake with an Entity (and a Community when your workspace uses multi-tenant mode), then select Create.
5. Copy the intake key of the new intake.

❗️

Protect the intake key

The intake key authorizes event submission to your Sekoia.io intake. Treat it as a secret. Do not put it in public issues, chat rooms, documentation, or source repositories.

Request Activation from Control D

1. Contact Control D Support while signed in to the Organization account.
2. Request Sekoia.io SIEM log streaming and provide:
   • the Organization and Sub-Organization IDs to include
   • the Analytics Storage Region
   • confirmation that the Sekoia.io workspace is in FRA1
3. Provide the Sekoia.io intake key only through the secure exchange method agreed with Support.
4. Wait for Support to confirm that the stream is active.

Control D sends the selected logs to https://intake.sekoia.io/plain/batch using TLS and the Sekoia.io intake-key header. No inbound firewall rule or customer-hosted receiver is required.

Verify the Integration

After Support confirms activation:

1. Generate a fresh DNS query from an Endpoint with Full Analytics enabled.
2. Confirm that the query appears in the Control D Activity Log.
3. Open the Events page in Sekoia.io and filter on the Control D DNS intake you created.
4. Confirm that the event is present with the expected timestamp, DNS question, observer.vendor: Control D, and the relevant Control D action.

Raw messages arriving on the intake are not proof of a working integration. The fields above must be populated, which shows that Sekoia.io parsed the event with the Control D DNS intake format.

See the Log Field Reference for the source fields supplied by Control D. Sekoia.io normalizes those fields through the Control D DNS intake format.

Troubleshooting

If events do not appear:

1. Confirm that Full Analytics remains enabled on the affected Endpoint.
2. Generate a new DNS query and confirm that it appears in the Control D Activity Log.
3. Confirm that the requested Organization and Sub-Organization IDs are correct.
4. Confirm that the Sekoia.io intake is enabled and its key has not been rotated.
5. Confirm that the Sekoia.io workspace is in the FRA1 region.
6. Contact Control D Support if the stream still produces no events.

Rotate or Replace the Intake Key

Rotating the intake key stops delivery until Control D updates the managed stream. Contact Control D Support to replace the key through an agreed secure exchange method, then verify a new event in Sekoia.io.