Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
minLevel1
maxLevel6
outlinefalse
typeflat
separatorbrackets
printablefalse
Image RemovedImage Added

Purpose

DNS alert pack is a set of detection focus on DNS traffic for an organization to detect malicious domain interaction.

Included alerts

SecOpsHostNameSubdomainLength

SecOpsHAFNIUMUserAgentsTargetingExchangeServers

SecOpsRevilKaseyaDomainConnection

SecOpsTLDFromDomainNotInMozillaTLD

SecOpsTooLongDNSResponse

SecOpsLog4ShellVulnOverDomainsUnionTableConnections

SecOpsLog4ShellVulnOverDomainsUnionTableConnectionsWithLookup

SecOpsHostDNSBasedCovertChannelIpv6Record

SecOpsDNSQueryToExternalSrvcInteractionDomains

Prerequisites

To use this alert pack, you must have the following data sources available on your domain:

  • network.dns

  • domains.all

Open alert pack 

Once you have installed the desired alerts individually, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find them and later manage them as required. You can also access this area via the Navigation pane (AdministrationAlert ConfigurationAvailable alerts).

Image RemovedPlatform alert packs (use alert pack).pngImage Added

Use alert pack 

The alerts installed are deactivated by default. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.