Skip to content

DNS and firewall AI discovery

DNS resolver, firewall egress, and endpoint detection and response (EDR) logs help Venturi detect direct AI-provider traffic that does not pass through an instrumented gateway.

Onboarding scope

This guide covers the read-only dns_firewall_log_analysis connector in the Venturi platform connector package. It reads log records and never changes DNS, firewall, or EDR policy.

Supported sources

Connect the log sources you already operate; Venturi does not require a specific vendor:

  • DNS resolver logs and analytics: Cisco Umbrella and NextDNS logs, plus Cloudflare Gateway’s grouped DNS analytics with adaptive sampling.
  • Firewall egress logs, for example Palo Alto Networks traffic logs.
  • EDR logs from CrowdStrike Falcon, Palo Alto Networks Cortex XDR, SentinelOne, and Microsoft Defender for Endpoint.

Required access

The names below are Venturi capability identifiers, not vendor scopes:

Venturi capability Purpose
dns.query_logs.readonly Read resolver query logs or source-specific DNS analytics.
firewall.connection_logs.readonly Read firewall egress logs.
edr.logs.readonly Read EDR network-connection logs.

Do not grant policy-write, blocking, allow-list, or firewall-rule mutation permissions. The Venturi capability names above are not pasted into a vendor console. Configure each selected source with its own vendor-side authorization:

Source Vendor-side authorization Read-only
Cloudflare Gateway DNS An API token with the Account → Account Analytics → Read permission; the connector queries grouped DNS metrics with adaptive sampling from gatewayResolverQueriesAdaptiveGroups through the GraphQL Analytics API. See Gateway analytics. Yes
Cisco Umbrella An Umbrella API key with only the read-only Reports scope reports.granularEvents:read, which reads /reports/v2/activity/dns. See Umbrella API key scopes. Yes
NextDNS The account API key, sent in the X-Api-Key header, which reads /profiles/{profile}/logs. See the NextDNS API. No
Palo Alto Networks firewall A dedicated administrator account whose Admin Role profile enables only the Log feature on the XML API tab, with no web interface, CLI, or REST API access, and the API key generated for that account. The connector retrieves traffic logs with type=log. See Enable API access and Retrieve logs. Yes
CrowdStrike Falcon The Falcon Data Replicator feed credentials that the Falcon console issues: an AWS client ID and secret and the SQS queue URL of the replicated event feed. See CrowdStrike’s Falcon Data Replicator. Yes
Palo Alto Networks Cortex XDR An API key and API key ID for the XQL query APIs. Cortex XDR runs XQL queries only for a key that includes the Instance Administrator role permissions. See Run XQL query APIs and Create a new API key. No
SentinelOne An API token for a dedicated SentinelOne service user assigned the predefined Viewer role at account or site scope. See SentinelOne’s role overview. Yes
Microsoft Defender for Endpoint A Microsoft Entra app registration with the Microsoft Graph application permission ThreatHunting.Read.All, which runs advanced hunting queries such as DeviceNetworkEvents through runHuntingQuery. Microsoft is retiring the older Defender for Endpoint advanced hunting API. See runHuntingQuery. Yes

Two supported sources offer no read-only credential. A NextDNS API key is account-wide: the same key can create, change, and delete profiles and clear logs. A Cortex XDR key that can run XQL queries carries Instance Administrator permissions. Connect either source only if that exception is acceptable. When you do, create the key for Venturi alone, store it only as an encrypted credential reference, and rotate it on your vendor schedule; the connector calls only the log-read and query endpoints listed above.

Cloudflare returns groups of DNS observations, not a complete event-by-event resolver log. Retain the queried dimensions, time window, aggregate counts, and sampling metadata where supplied. A returned row is a group, so row counts do not equal DNS request counts. Label coverage and comparisons with raw logs using that aggregation and sampling scope; matching time windows alone do not establish equivalent coverage.

How matches work

The connector matches each queried or destination domain by suffix against a versioned registry of AI-provider domains, so api.openai.com matches the openai.com entry. The registry covers the domains of OpenAI (including ChatGPT), Anthropic (including Claude), Google Gemini and the Gemini API, Microsoft Copilot, GitHub Copilot, Perplexity, Midjourney, Character.AI, Cohere, Mistral AI, and Hugging Face. When a log record carries only a destination IP address, the connector matches it against the IP ranges that a provider publishes for its endpoints, where the provider publishes them. A match on a provider API host, such as api.openai.com, counts as stronger evidence of direct API use than a match on a provider’s web domain.

Results are provider domain/IP matches: DNS and ordinary firewall logs do not expose URL paths without TLS inspection, which this connector does not perform. Venturi reviews and dates each registry update and ships it with the connector package.

Setup

  1. Select DNS, firewall, and EDR sources with AI-provider egress visibility.
  2. Create the vendor-side authorization in the table above for each selected source.
  3. Store each credential as an encrypted credential reference in Settings / Admin / Credentials.
  4. The default lookback is 24 hours; set VENTURI_DNS_FIREWALL_LOOKBACK_HOURS to change it. See sync windows and failure behavior.
  5. In Venturi, go to Integrations / DNS and firewall AI discovery and run Test connection.

Verification

  • Test connection passes the read-only boundary check: log reads succeed, and each read-only credential in the table above cannot change DNS, firewall, or EDR policy.
  • A NextDNS or Cortex XDR key, if connected, is dedicated to Venturi and appears only as an encrypted credential reference in Settings / Admin / Credentials.
  • The connector reports a ready source for each reachable log source.
  • Provider domain/IP matches appear as detected-only observations labeled as discovery evidence, not request attribution.

Rotation and offboarding

Rotate log-reader credentials through the relevant DNS, firewall, or EDR system, then update the credential reference in Settings / Admin / Credentials. Removing the connector stops new detected-only observations from those logs.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: DNS and firewall AI discovery
Page: https://docs.venturi.systems/connectors/dns-firewall-log-analysis/