topic Re: Does xdr_data log failed DNS queries? in Cortex XDR Discussions

Does xdr_data log failed DNS queries?

tmeksik — Fri, 26 Jul 2024 00:19:56 GMT

Hi team

We are trying to see if XDR agent logged any failed DNS queries... Basically a DNS query made on non-existing domain names.

Can't seem to be able to pull this info out.

Thanks

Re: Does xdr_data log failed DNS queries?

tmeksik — Fri, 26 Jul 2024 04:34:09 GMT

To further clarify the situation, we don't have PAN's NGFW or other log sources concerning the outgoing traffic and were trying to obtain this info via xdr_data.

Re: Does xdr_data log failed DNS queries?

jmazzeo — Fri, 26 Jul 2024 12:25:57 GMT

Hi @tmeksik, thanks for reaching us using the Live Community.

I have this XQL Query to share with you that can do the job:

preset= network_story | filter agent_hostname = "HostName" // If needed | filter (dns_query_name != null) | arrayexpand dns_resolutions | alter resType = dns_resolutions -> type{} , ipAddr = dns_resolutions -> value{}, domainName = dns_resolutions -> name{} | filter (resType = """\"A\"""") | fields domainName, ipAddr , dns_query_type , dns_query_name, dns_resolutions, actor_process_image_name, dns_reply_code

The dns_reply_code show "Non-Existent Domain" when that response is received on the endpoint, and you can filter it as you need.

If this post answers your question, please mark it as the solution.

Re: Does xdr_data log failed DNS queries?

tmeksik — Mon, 29 Jul 2024 22:07:32 GMT

Hi JM

Thanks for the reply. I don't seem to have seen "Non-existent domain" anywhere. Have tested out by deliberately query non=existing domains on the endpoint. All I've got from that duration were all the normal "No Error" entries.

It sound to me like all DNS queries should have been logged? Any ideas what could the case I didn't see any failed resolution here??

Thanks

Re: Does xdr_data log failed DNS queries?

jmazzeo — Tue, 30 Jul 2024 13:39:35 GMT

Do you have Pro license? Or Prevent? Also sometimes the XTH Add-on is required. You can check here the data retrived from the endpoint: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Data-Collection

Re: Does xdr_data log failed DNS queries?

tmeksik — Tue, 30 Jul 2024 21:35:52 GMT

It's the Pro per endpoint license.

What do you mean by 'sometimes XTH add-on is required'? XTH was added as a trial a while back but long expired I believe. It should be either required or not required though, 'sometimes' sounds a bit odd..

Looked at the link you copied, yeah "DNS request and UDP response" was listed as what EDR collected which makes sense and should include all UDP DNS requests and responses? We see from our own testing that certain failed requests just weren't there though.