https://community.splunk.com/t5/Security/Dns-Queries/m-p/163978#M4872 <P>Great, Thanks!</P> Mon, 24 Feb 2014 22:42:53 GMT eamonnr 2014-02-24T22:42:53Z https://community.splunk.com/t5/Security/Dns-Queries/m-p/163976#M4870 <P>Is it possible to create a splunk alert anytime a domain name is queried for the 1st time within an organisation? E.G. An employee clicks on a link in a phishing email?</P> Mon, 24 Feb 2014 21:11:28 GMT https://community.splunk.com/t5/Security/Dns-Queries/m-p/163976#M4870 eamonnr 2014-02-24T21:11:28Z https://community.splunk.com/t5/Security/Dns-Queries/m-p/163977#M4871 <P>Sure, provided you have events in Splunk that tell you when a DNS query occurred for what host.</P> <P>You'd build a summary index that stores the first occurrence for each queried host. You'd write a summarizing search that adds new hosts to that summary index frequently, and an alert that fires whenever new data is added to the summary index.</P> Mon, 24 Feb 2014 21:46:15 GMT https://community.splunk.com/t5/Security/Dns-Queries/m-p/163977#M4871 martin_mueller 2014-02-24T21:46:15Z https://community.splunk.com/t5/Security/Dns-Queries/m-p/163978#M4872 <P>Great, Thanks!</P> Mon, 24 Feb 2014 22:42:53 GMT https://community.splunk.com/t5/Security/Dns-Queries/m-p/163978#M4872 eamonnr 2014-02-24T22:42:53Z