Does xdr_data log failed DNS queries?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Does xdr_data log failed DNS queries?

L2 Linker

Hi team

 

We are trying to see if XDR agent logged any failed DNS queries... Basically a DNS query made on non-existing domain names.

 

Can't seem to be able to pull this info out.

 

Thanks

5 REPLIES 5

L2 Linker

To further clarify the situation, we don't have PAN's NGFW or other log sources concerning the outgoing traffic and were trying to obtain this info via xdr_data.

Hi @tmeksik, thanks for reaching us using the Live Community.

 

I have this XQL Query to share with you that can do the job:

 

 

preset= network_story 
| filter agent_hostname = "HostName" // If needed
| filter (dns_query_name != null) 
| arrayexpand dns_resolutions 
| alter resType = dns_resolutions -> type{} ,  ipAddr = dns_resolutions -> value{}, domainName = dns_resolutions -> name{}
| filter (resType = """\"A\"""") 
| fields domainName, ipAddr , dns_query_type , dns_query_name, dns_resolutions, actor_process_image_name, dns_reply_code 

 

 

The dns_reply_code show "Non-Existent Domain" when that response is received on the endpoint, and you can filter it as you need.

 

If this post answers your question, please mark it as the solution.

JM

L2 Linker

Hi JM

 

Thanks for the reply. I don't seem to have seen "Non-existent domain" anywhere. Have tested out by deliberately query non=existing domains on the endpoint. All I've got from that duration were all the normal "No Error" entries.

It sound to me like all DNS queries should have been logged? Any ideas what could the case I didn't see any failed resolution here??

Thanks

Do you have Pro license? Or Prevent? Also sometimes the XTH Add-on is required. You can check here the data retrived from the endpoint: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Da...

 

JM

L2 Linker

It's the Pro per endpoint license.

 

What do you mean by 'sometimes XTH add-on is required'? XTH was added as a trial a while back but long expired I believe. It should be either required or not required though, 'sometimes' sounds a bit odd..

 

Looked at the link you copied, yeah "DNS request and UDP response" was listed as what EDR collected which makes sense and should include all UDP DNS requests and responses? We see from our own testing that certain failed requests just weren't there though.

  • 787 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!