mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
19 lines
1.7 KiB
YAML
19 lines
1.7 KiB
YAML
name: Discover DNS records
|
|
id: c096f721-8842-42ce-bfc7-74bd8c72b7c3
|
|
version: 3
|
|
creation_date: '2019-10-16'
|
|
modification_date: '2026-05-13'
|
|
author: Jose Hernandez, Splunk
|
|
status: production
|
|
description: The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup
|
|
search: '| inputlookup cim_corporate_email_domain_lookup | inputlookup append=T cim_corporate_web_domain_lookup | inputlookup append=T cim_cloud_domain_lookup | eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?<domain>\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records'
|
|
how_to_implement: To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation
|
|
known_false_positives: No false positives have been identified at this time.
|
|
references: []
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
security_domain: network
|
|
schedule: Default Baseline
|