From 09c7a947f3c8eafe6a9b7ec759b940591b9ae2ac Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 21 Dec 2022 13:14:38 -0800
Subject: [PATCH] spl update per git issue

---
 .../network/excessive_dns_failures.yml        | 36 +++++++++++--------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/detections/experimental/network/excessive_dns_failures.yml b/detections/experimental/network/excessive_dns_failures.yml
index cec2f83d3c..3da3bd7a1d 100644
--- a/detections/experimental/network/excessive_dns_failures.yml
+++ b/detections/experimental/network/excessive_dns_failures.yml
@@ -1,20 +1,25 @@
 name: Excessive DNS Failures
 id: 104658f4-afdc-499e-9719-17243f9826f1
-version: 2
-date: '2020-07-21'
-author: Bhavin Patel, Splunk
+version: 3
+date: '2022-12-21'
+author: bowesmana, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
 - Network_Resolution
 description: This search identifies DNS query failures by counting the number of DNS
   responses that do not indicate success, and trigger on more than 50 occurrences.
-search: '| tstats `security_content_summariesonly` count values("DNS.query") as queries
-  from datamodel=Network_Resolution where nodename=DNS "DNS.reply_code"!="No Error"
-  "DNS.reply_code"!="NoError" DNS.reply_code!="unknown" NOT "DNS.query"="*.arpa" "DNS.query"="*.*"
-  by "DNS.src","DNS.query"| `drop_dm_object_name("DNS")`| lookup cim_corporate_web_domain_lookup
-  domain as query OUTPUT domain| where isnull(domain)| lookup update=true alexa_lookup_by_str
-  domain as query OUTPUT rank| where isnull(rank)| stats sum(count) as count mode(queries)
-  as queries by src| `get_asset(src)`| where count>50 | `excessive_dns_failures_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where nodename=DNS "DNS.reply_code"!="No Error" "DNS.reply_code"!="NoError" DNS.reply_code!="unknown" NOT "DNS.query"="*.arpa" "DNS.query"="*.*" by "DNS.src" "DNS.query" "DNS.reply_code"
+| `drop_dm_object_name("DNS")` 
+| lookup cim_corporate_web_domain_lookup domain as query OUTPUT domain 
+| where isnull(domain) 
+| lookup update=true alexa_lookup_by_str domain as query OUTPUT rank 
+| where isnull(rank) 
+| eventstats max(count) as mc by src reply_code
+| eval mode_query=if(count=mc, query, null()) 
+| stats sum(count) as count values(mode_query) as query values(mc) as max_query_count by src reply_code
+| where count>50 
+| `get_asset(src)` 
+| `excessive_dns_failures_filter` '
 how_to_implement: To successfully implement this search you must ensure that DNS data
   is populating the Network_Resolution data model.
 known_false_positives: It is possible legitimate traffic can trigger this rule. Please
@@ -52,10 +57,11 @@ tags:
   confidence: 50
   impact: 50
   risk_score: 25
-  context: []
-  message: tbd
+  context:
+  - Source:Endpoint
+  message: Excessive DNS failures detected on $src$
   observable:
-  - name: dest
-    type: Other
+  - name: src
+    type: Hostname
     role:
-    - Other
+    - Victim
\ No newline at end of file