mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
48 lines
1.4 KiB
JSON
48 lines
1.4 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-04-10",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"DNS"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream",
|
|
"Bro"
|
|
]
|
|
},
|
|
"description": "While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.",
|
|
"how_to_implement": "To successfully implement this search, you must be ingesting your DNS traffic",
|
|
"id": "ee11a8cf-35e7-4bb2-8140-e756cc06fd72",
|
|
"investigate": {
|
|
"splunk": {
|
|
"fields_required": [
|
|
"src_ip"
|
|
],
|
|
"search": "| search tag=dns src_ip={src_ip} dest_port=53 | streamstats time_window=1d count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort -count",
|
|
"window": {
|
|
"earliest_time_offset": 0,
|
|
"latest_time_offset": 86400
|
|
}
|
|
}
|
|
},
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2017-11-09",
|
|
"name": "Get DNS Server History for a host",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"spec_version": 2,
|
|
"product_type": "splunk",
|
|
"version": "1.0"
|
|
}
|