Getting Data In

How to detect users using DNS different than organization DNS

abdallahalhabba
New Member

Dear All
Good Day
I need search detect users using DNS different than Organization DNS. Please share me your ideas & suggestion .

Tags (2)
0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @abdallahalhabbash, If richgalloway solved your problem, please remember to "Accept" his answer to award karma points. 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming you're already collecting network metadata (either from Stream, your proxy server, firewall logs, etc.) then you just need to look for events going to port 53 with a destination IP address not in your network.

---
If this reply helps you, an upvote would be appreciated.
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.