- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
07-25-2024 05:19 PM
Hi team
We are trying to see if XDR agent logged any failed DNS queries... Basically a DNS query made on non-existing domain names.
Can't seem to be able to pull this info out.
Thanks
07-26-2024 05:25 AM - edited 07-26-2024 05:25 AM
Hi @tmeksik, thanks for reaching us using the Live Community.
I have this XQL Query to share with you that can do the job:
preset= network_story
| filter agent_hostname = "HostName" // If needed
| filter (dns_query_name != null)
| arrayexpand dns_resolutions
| alter resType = dns_resolutions -> type{} , ipAddr = dns_resolutions -> value{}, domainName = dns_resolutions -> name{}
| filter (resType = """\"A\"""")
| fields domainName, ipAddr , dns_query_type , dns_query_name, dns_resolutions, actor_process_image_name, dns_reply_code
The dns_reply_code show "Non-Existent Domain" when that response is received on the endpoint, and you can filter it as you need.
If this post answers your question, please mark it as the solution.
07-29-2024 03:07 PM
Hi JM
Thanks for the reply. I don't seem to have seen "Non-existent domain" anywhere. Have tested out by deliberately query non=existing domains on the endpoint. All I've got from that duration were all the normal "No Error" entries.
It sound to me like all DNS queries should have been logged? Any ideas what could the case I didn't see any failed resolution here??
Thanks
07-30-2024 06:39 AM
Do you have Pro license? Or Prevent? Also sometimes the XTH Add-on is required. You can check here the data retrived from the endpoint: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Da...
07-30-2024 02:35 PM
It's the Pro per endpoint license.
What do you mean by 'sometimes XTH add-on is required'? XTH was added as a trial a while back but long expired I believe. It should be either required or not required though, 'sometimes' sounds a bit odd..
Looked at the link you copied, yeah "DNS request and UDP response" was listed as what EDR collected which makes sense and should include all UDP DNS requests and responses? We see from our own testing that certain failed requests just weren't there though.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!