{
  "creation_date": "2017-04-10",
  "data_metadata": {
    "data_source": [
      "DNS"
    ],
    "providing_technologies": [
      "Splunk Stream",
      "Bro"
    ]
  },
  "description": "While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.",
  "how_to_implement": "To successfully implement this search, you must be ingesting your DNS traffic",
  "id": "c096f721-8842-42ce-bfc7-74bd8c72b712",
  "investigate": {
    "phantom": {
      "phantom_server": "automation (hostname)",
      "playbook_name": "community/dns_hijack_investigation",
      "playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/",
      "sensitivity": "green",
      "severity": "medium",
      "window": {
        "earliest_time_offset": 0,
        "latest_time_offset": 86400
      }
    }
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2017-11-09",
  "name": "DNS record change investigation",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "spec_version": 2,
  "product_type": "phantom",
  "version": "1.0"
}