- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
DNS query in threat intelligence of Enterprise Security
rossikwan
Path Finder
10-02-2019
01:23 AM
Hi,
Configured the proxy for retrieving threat intelligence in Enterprise Security and its succesfully retrieved those feed.
As the local Splunk server DNS query will be stopped for external Internet name query soon, I am in doubt that the retrival of the threat intelligence will be failed as the Enterprise Security can't have the DNS query results from the proxy server.
Will it need to keep the local Splunk server have the external DNS query in order to have the retrieving threat intelligence succesful?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

harsmarvania57
Ultra Champion
10-02-2019
05:26 AM
Hi,
As you are downloading threat feed via proxy, it is not required for Splunk Server to have external DNS access, proxy will resolve those DNS queries and serve the request.
