If you ever heard me talk about DNS, you will know that I am a big fan of monitoring DNS queries, and I think DNS query logs are the best “band for the buck” log source to detect anomalous behavior. Everything that happens on your network, good or bad, tends to be reflected in DNS.
Article Link: https://isc.sans.edu/diary/rss/24844