Sunturai
Back to results
MediumMicrosoft Sentinel analyticsYaron

Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)

This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source…

Description

This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema

Detection logic

Detection requirements

Platform
ESXiLinuxmacOSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
azurefirewallciscoumbrelladataconnectorcorelightdnsgcpdnsdataconnectorinfobloxniosnxlogdnslogszscaler
Log source service
azurediagnosticscisco_umbrella_dns_clcommonsecuritylogcorelight_cldnseventsgcp_dns_clnxlog_dns_server_clsyslog

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice