name: Monitor DNS For Brand Abuse
id: 24dd17b1-e2fb-4c31-878c-d4f746595bfa
version: 1
date: '2017-09-23'
author: David Dorsey, Splunk
type: batch
datamodel:
- Network_Resolution
description: This search looks for DNS requests for faux domains similar to the domains
  that you want to have monitored for abuse.
search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time)
  as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name("DNS")`
  | `security_content_ctime(firstTime)`| `brand_abuse_dns` | `monitor_dns_for_brand_abuse_filter`'
how_to_implement: You need to ingest data from your DNS logs. Specifically you must
  ingest the domain that is being queried and the IP of the host originating the request.
  Ideally, you should also be ingesting the answer to the query and the query type.
  This approach allows you to also create your own localized passive DNS capability
  which can aid you in future investigations. You also need to have run the search
  "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that
  will be checked for.
known_false_positives: None at this time
references: []
tags:
  analytic_story:
  - Brand Monitoring
  asset_type: Endpoint
  kill_chain_phases:
  - Delivery
  - Actions on Objectives
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: network
