topic Re: Suspicious DNS Query list in General Topics

Suspicious DNS Query list

craigmueller — Fri, 15 Aug 2014 21:06:04 GMT

Hello,

Is there a list of all the DNS Querys that PA considers suspicious?

I was considering changing the default action from alert to block for these signatures.

Since there is potentially 1 million URLs that will automatically get blocked when adjusted, my client might want to go over the list before making the decision.

Thanks!

Re: Suspicious DNS Query list

jvalentine — Fri, 15 Aug 2014 21:24:21 GMT

That list is a "living database" and changes over time. I think a better method to use with your customer would be to understand "what would have been blocked". You can run a simple custom report to answer that question. Use the "Threat Log" as your data source and use the following options (feel free to change your timeframe - just keep in mind the longer the timeframe the longer the report may take to run. Start small ~1 day and then work your way up).

In my small lab environment, the output looks like this:

Re: Suspicious DNS Query list

pulukas — Sat, 16 Aug 2014 00:17:13 GMT

I agree with Jared. Even if you could see the whole database, and the chances are low that PA would allow that. I'm sure they consider those contents a trade secret they want to keep from the competition, the report is more relevant.

The report tells you what your users are likely to see on your network.

Remember also that generally when a default action is to alert instead of block, there is a much higher possibility of a false positive. So you may generate some work allowing blocked sites after the action is changed.

Re: Suspicious DNS Query list

craigmueller — Mon, 18 Aug 2014 14:40:41 GMT

Thanks for your replies.