diff --git a/detections/dyn_dns_queries.json b/detections/dyn_dns_queries.json index f6942342fc..7a59241280 100644 --- a/detections/dyn_dns_queries.json +++ b/detections/dyn_dns_queries.json @@ -44,12 +44,12 @@ } } }, - "eli5": "The search is querying an accelerated `Network_Resolution` data model to count and list the values of resolved domains for each DNS query and checks that against the list of Dynamic DNS providers (lookup - `dynamic_dns_providers`) by each host (DNS.src)", + "eli5": "The search leverages an accelerated Network_Resolution data model to count and list the values of resolved domains for each DNS query. It checks the results against the list of Dynamic DNS providers in the lookup dynamic_dns_providers by each host (DNS.src).", "entities": [ "dest", "query" ], - "how_to_implement": "First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data collected passively by Splunk Stream or similar solutions. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the Network_Resolution data model. This search also leverages a lookup file, dynamic_dns_providers_default.csv, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of dynamic_dns_providers_local.csv.

This search produces fields (`query`,`answer`,`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):



Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`", + "how_to_implement": "First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the Network_Resolution data model. This search also leverages a lookup file, dynamic_dns_providers_default.csv, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of dynamic_dns_providers_local.csv.

This search produces fields (query, answer, isDynDNS) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable event. To see the additional metadata, add the following fields, if not already present, to Incident Review. Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):



Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`", "id": "c77162d3-f93c-45cc-80c8-22f6v5464g9f", "investigations": [ { @@ -103,4 +103,4 @@ "spec_version": 2, "type": "splunk", "version": "1.0" -} \ No newline at end of file +}