How to find DNS querys from LAN zone to WAN Zone

That is not possible in the firewall. We are not storing DNS requests in the firewall, as this would need a huge database to store all those datas. 

The endpoint can do this. If you have XDR. 

Do you have any query that can help me? Because in live discover I dont find nothing about DNS querys

Try this: https://community.sophos.com/intercept-x-endpoint/i/uncategorized/live-discover-query-for-all-dns-requests-in-a-time-frame-with-process-ztna-app-discover

Thanks, that work for me. But I still confuse on the fact that we can log anything else (even on data lake) but not log the DNS querys.

Think about the amount of data you would have to store. A client can potentially bring up more than one request per second (easily). If you start to log this kind of data within a product, this will end up in a "large log". Let put it like that. DNS works with TTLs, so if you have to query the same DNS all the time, you have to store this as well, because it could potentially change etc. So there is no end in storing data for "little use". 

Think about the amount of data you would have to store. A client can potentially bring up more than one request per second (easily). If you start to log this kind of data within a product, this will end up in a "large log". Let put it like that. DNS works with TTLs, so if you have to query the same DNS all the time, you have to store this as well, because it could potentially change etc. So there is no end in storing data for "little use".