author: Bhavin Patel, Splunk
date: '2017-11-09'
description: 'This search calculates the ratio of DNS traffic originating and coming
  from a host to a list of DNS servers over the last 24 hours. A high value of this
  ratio could be very useful to quickly understand if a src_ip (host) is sending a
  high volume of data out via port 53, could be an indicator of data exfiltration
  via DNS.  '
how_to_implement: You must be ingesting your network traffic
id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73
inputs:
- src_ip
- dest_ip
name: Get DNS traffic ratio
search: '| tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out"
  sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic where nodename=All_Traffic
  All_Traffic.dest_port=53 by All_Traffic.src All_Traffic.dest| `drop_dm_object_name(All_Traffic)`
  | rename src as src_ip | rename dest as dest_ip | search src_ip=$src_ip$ | search
  dest_ip = $dest_ip | eval ratio = (bytes_out/bytes_in) | table ratio'
tags:
  analytic_story:
  - AWS Network ACL Activity
  - Command and Control
  - Data Protection
  - Dynamic DNS
  - Hidden Cobra Malware
  - Suspicious AWS Traffic
  - Suspicious DNS Traffic
  product:
  - Splunk Phantom
type: response
version: 1
