I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source address as the one from the DNS server.
How do I forward all requests to ns.example.com to an isolated server to see which PC is making the requests?
