https://community.splunk.com/t5/Getting-Data-In/How-to-detect-users-using-DNS-different-than-organization-DNS/m-p/335113#M61995 <P>Assuming you're already collecting network metadata (either from Stream, your proxy server, firewall logs, etc.) then you just need to look for events going to port 53 with a destination IP address not in your network.</P> Thu, 14 Sep 2017 13:30:45 GMT richgalloway 2017-09-14T13:30:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-detect-users-using-DNS-different-than-organization-DNS/m-p/335112#M61994 <P>Dear All <BR /> Good Day <BR /> I need search detect users using DNS different than Organization DNS. Please share me your ideas &amp; suggestion . </P> Thu, 14 Sep 2017 11:30:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-detect-users-using-DNS-different-than-organization-DNS/m-p/335112#M61994 abdallahalhabba 2017-09-14T11:30:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-detect-users-using-DNS-different-than-organization-DNS/m-p/335113#M61995 <P>Assuming you're already collecting network metadata (either from Stream, your proxy server, firewall logs, etc.) then you just need to look for events going to port 53 with a destination IP address not in your network.</P> Thu, 14 Sep 2017 13:30:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-detect-users-using-DNS-different-than-organization-DNS/m-p/335113#M61995 richgalloway 2017-09-14T13:30:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-detect-users-using-DNS-different-than-organization-DNS/m-p/335114#M61996 <P>Hey @abdallahalhabbash, If richgalloway solved your problem, please remember to "Accept" his answer to award karma points. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 15 Sep 2017 01:30:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-detect-users-using-DNS-different-than-organization-DNS/m-p/335114#M61996 lfedak_splunk 2017-09-15T01:30:55Z