Does xdr_data log failed DNS queries?

[tmeksik]

Hi team

We are trying to see if XDR agent logged any failed DNS queries... Basically a DNS query made on non-existing domain names.

Can't seem to be able to pull this info out.

Thanks

[tmeksik]

To further clarify the situation, we don't have PAN's NGFW or other log sources concerning the outgoing traffic and were trying to obtain this info via xdr_data.

[jmazzeo]

Hi @tmeksik, thanks for reaching us using the Live Community.

I have this XQL Query to share with you that can do the job:

preset= network_story 
| filter agent_hostname = "HostName" // If needed
| filter (dns_query_name != null) 
| arrayexpand dns_resolutions 
| alter resType = dns_resolutions -> type{} ,  ipAddr = dns_resolutions -> value{}, domainName = dns_resolutions -> name{}
| filter (resType = """\"A\"""") 
| fields domainName, ipAddr , dns_query_type , dns_query_name, dns_resolutions, actor_process_image_name, dns_reply_code 

The dns_reply_code show "Non-Existent Domain" when that response is received on the endpoint, and you can filter it as you need.

If this post answers your question, please mark it as the solution.

[tmeksik]

Hi JM

Thanks for the reply. I don't seem to have seen "Non-existent domain" anywhere. Have tested out by deliberately query non=existing domains on the endpoint. All I've got from that duration were all the normal "No Error" entries.

It sound to me like all DNS queries should have been logged? Any ideas what could the case I didn't see any failed resolution here??

Thanks

[jmazzeo]

Do you have Pro license? Or Prevent? Also sometimes the XTH Add-on is required. You can check here the data retrived from the endpoint: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Da...

[tmeksik]

It's the Pro per endpoint license.

What do you mean by 'sometimes XTH add-on is required'? XTH was added as a trial a while back but long expired I believe. It should be either required or not required though, 'sometimes' sounds a bit odd..

Looked at the link you copied, yeah "DNS request and UDP response" was listed as what EDR collected which makes sense and should include all UDP DNS requests and responses? We see from our own testing that certain failed requests just weren't there though.