Security

Dns Queries

eamonnr
New Member

Is it possible to create a splunk alert anytime a domain name is queried for the 1st time within an organisation? E.G. An employee clicks on a link in a phishing email?

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Sure, provided you have events in Splunk that tell you when a DNS query occurred for what host.

You'd build a summary index that stores the first occurrence for each queried host. You'd write a summarizing search that adds new hosts to that summary index frequently, and an alert that fires whenever new data is added to the summary index.

0 Karma

eamonnr
New Member

Great, Thanks!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...