I need help on how I can tune the search below. It creates too much noise. I will like to know what steps I can use to tune or if there is better SPL available that can be used.
| tstats summariesonly=t dc("DNS.query") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa" NOT ("DNS.src_category"="svc_infra_dns" OR "DNS.src_category"="svc_infra_webproxy" OR "DNS.src_category"="svc_infra_email*" ) by "DNS.src","DNS.query" | rename "DNS.src" as src "DNS.query" as message
| eval length=len(message) | stats sum(length) as length by src
| append [ tstats summariesonly=t dc("DNS.answer") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa" NOT ("DNS.src_category"="svc_infra_dns" OR "DNS.src_category"="svc_infra_webproxy" OR "DNS.src_category"="svc_infra_email*" ) by "DNS.src","DNS.answer"
| rename "DNS.src" as src "DNS.answer" as message
| eval message=if(message=="unknown","", message)
| eval length=len(message)
| stats sum(length) as length by src ]
| stats sum(length) as length by src | where length > 10000
Hello @yawdeals ,
I'm not sure you can detect DNS tunneling using such simple method. What about to do it right?: https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022
I read the document and will like to know if there is an SPL that i can use as a starting point?
For those looking into this:
https://docs.splunksecurityessentials.com/content-detail/detection_of_dns_tunnels/
This is showing as 404 now, do we know where the resource might be? I'm putting together a query for tunneling so any hints would be useful!
https://docs.splunksecurityessentials.com/content-detail/showcase_huge_volume_dns_requests/
Now is the updated DNS tunnelling article