×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
cpnewton
Explorer
Member since: ‎05-07-2013
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 1
Member Since ‎05-07-2013
View All

Re: streams and DNS over (HTTPS or TLS)...DoH/DoT

by in Splunk Enterprise Security
‎07-02-2019 09:12 PM
‎07-02-2019 09:12 PM
And there is already malware leveraging. DNS over HTTP https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/ ... View more

Re: streams and DNS over (HTTPS or TLS)...DoH/DoT

by in Splunk Enterprise Security
‎07-02-2019 09:10 PM
‎07-02-2019 09:10 PM
Monitoring the log file on a windows dns server is not feasible on very highly active systems and the awful way windows dns does logging. So, stream has to be used to collect that dns data, therefore it seems that any encrypted traffic payload will be unavailable to the stream app. ... View more

streams and DNS over (HTTPS or TLS)...DoH/DoT

by in Splunk Enterprise Security
‎06-27-2019 06:46 AM
1 Karma
‎06-27-2019 06:46 AM
1 Karma
How will Splunk address encrypted DNS collection? It's weird you need to have karma points to post a link, look up the RFC to see what it's about. rfc8484 rfc7858 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma from
View All