admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2490 from splunk/bug_2415_dns

Browse Source 
Issue: 2415
This commit is contained in:
Bhavin Patel
2023-01-10 11:34:04 -08:00
committed by GitHub
parent c7b83d574c 9d3962ebdb
commit eaa7a469bb
1 changed files with 21 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/network/excessive_dns_failures.yml
+21 -15
View File
@@ -1,20 +1,25 @@
name: Excessive DNS Failures
id: 104658f4-afdc-499e-9719-17243f9826f1
version: 2
date: '2020-07-21'
author: Bhavin Patel, Splunk
version: 3
date: '2022-12-21'
author: bowesmana, Bhavin Patel, Splunk
type: Anomaly
datamodel:
- Network_Resolution
description: This search identifies DNS query failures by counting the number of DNS
responses that do not indicate success, and trigger on more than 50 occurrences.
search: '| tstats `security_content_summariesonly` count values("DNS.query") as queries
from datamodel=Network_Resolution where nodename=DNS "DNS.reply_code"!="No Error"
"DNS.reply_code"!="NoError" DNS.reply_code!="unknown" NOT "DNS.query"="*.arpa" "DNS.query"="*.*"
by "DNS.src","DNS.query"| `drop_dm_object_name("DNS")`| lookup cim_corporate_web_domain_lookup
domain as query OUTPUT domain| where isnull(domain)| lookup update=true alexa_lookup_by_str
domain as query OUTPUT rank| where isnull(rank)| stats sum(count) as count mode(queries)
as queries by src| `get_asset(src)`| where count>50 | `excessive_dns_failures_filter`'
search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where nodename=DNS "DNS.reply_code"!="No Error" "DNS.reply_code"!="NoError" DNS.reply_code!="unknown" NOT "DNS.query"="*.arpa" "DNS.query"="*.*" by "DNS.src" "DNS.query" "DNS.reply_code"
| `drop_dm_object_name("DNS")`
| lookup cim_corporate_web_domain_lookup domain as query OUTPUT domain
| where isnull(domain)
| lookup update=true alexa_lookup_by_str domain as query OUTPUT rank
| where isnull(rank)
| eventstats max(count) as mc by src reply_code
| eval mode_query=if(count=mc, query, null())
| stats sum(count) as count values(mode_query) as query values(mc) as max_query_count by src reply_code
| where count>50
| `get_asset(src)`
| `excessive_dns_failures_filter` '
how_to_implement: To successfully implement this search you must ensure that DNS data
is populating the Network_Resolution data model.
known_false_positives: It is possible legitimate traffic can trigger this rule. Please
@@ -52,10 +57,11 @@ tags:
confidence: 50
impact: 50
risk_score: 25
context: []
message: tbd
context:
- Source:Endpoint
message: Excessive DNS failures detected on $src$
observable:
- name: dest
type: Other
- name: src
type: Hostname
role:
- Other
- Victim