topic Does Network resolution datamodel includes outbound and inbound DNS transfers? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Network-resolution-datamodel-includes-outbound-and-inbound/m-p/641220#M11468 <P>Does the network resolution datamodel includes both Outbound and Inbound DNS transfers?</P> Tue, 25 Apr 2023 07:06:57 GMT Woodpecker 2023-04-25T07:06:57Z Does Network resolution datamodel includes outbound and inbound DNS transfers? https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Network-resolution-datamodel-includes-outbound-and-inbound/m-p/641220#M11468 <P>Does the network resolution datamodel includes both Outbound and Inbound DNS transfers?</P> Tue, 25 Apr 2023 07:06:57 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Network-resolution-datamodel-includes-outbound-and-inbound/m-p/641220#M11468 Woodpecker 2023-04-25T07:06:57Z Re: Does Network resolution datamodel includes outbound and inbound DNS transfers? https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Network-resolution-datamodel-includes-outbound-and-inbound/m-p/641238#M11469 <P>The datamodel includes query_type field so depending on your source, its configuration and the add-on you're using for data ingestion, I suppose it might include AXFR or IXFR. But I'd test before relying on it.</P> Tue, 25 Apr 2023 08:51:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Network-resolution-datamodel-includes-outbound-and-inbound/m-p/641238#M11469 PickleRick 2023-04-25T08:51:09Z