Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Checks for an anomalous increase in DNS activity per client in the last 24 hours as compared to the last 14 days. Please note: To enhance performance, this query uses summarized data if available. The Hunting query also depends on the "DNSEssentialsCustomParser" Parser, so please make sure it is installed and configured before you use this Hunting query.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | DNS Essentials |
| ID | 50f0cdfb-8b01-4eca-823d-2bbe6b8a5b95 |
| Tactics | CommandAndControl, Exfiltration |
| Techniques | T1568, T1008, T1048 |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
Anomalies |
✓ | ✓ | ✓ |
DNS_Summarized_Logs_ipV1_CL 🔶 |
? | ✓ | ? |
DNS_Summarized_Logs_ip_CL 🔶 |
? | ✓ | ? |
DNS_Summarized_Logs_sourceInfoV1_CL 🔶 |
? | ✓ | ? |
DNS_Summarized_Logs_sourceInfo_CL 🔶 |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊