topic DNS resolution was wrong for Firewall alerts in Cortex XDR Discussions

DNS resolution was wrong for Firewall alerts

Antony_Chan — Fri, 02 Jun 2023 09:35:13 GMT

Dear LIVEcommunity,

Did anyone encounter problem such as hostname does not match with the IP address for alert ingested from NGFW?

This is especially true when come to host that doesn't have Cortex XDR agent installed. Now, if the host cannot install with Cortex XDR agent for whatever reason, is there any way that I could improve the accuracy of the DNS resolution?

Right now, I'm considering DNS server log ingestion. But I'm uncertain that it will solve the issue.

Thank you.

Re: DNS resolution was wrong for Firewall alerts

anlynch — Mon, 05 Jun 2023 20:56:18 GMT

Hi @Antony_Chan,

I'm looking into this issue and i'll get back to you as soon as I have something.

Re: DNS resolution was wrong for Firewall alerts

afurze — Wed, 14 Jun 2023 16:57:29 GMT

Hi Myu06kkn,

Since you have a Pro per TB license, you can ingest your Microsoft DHCP logs which will help improve this data (assuming that the endpoint in question is receiving an IP address assignment from DHCP). These logs can be ingested with the XDR Collector and configuring it to ingest Microsoft DHCP log files.

Re: DNS resolution was wrong for Firewall alerts

Antony_Chan — Thu, 15 Jun 2023 06:06:28 GMT

@afurze Thanks for the input. In my case, it was static IP address that assigned to servers. So DHCP log ingestion may not be applicable. I'll keep that in mind if the same issue occurred to DHCP hosts.