Does anyone know if it is possible to monitor for NXDOMAIN Unknown Answers (Failures) with PanOS 5.0 ?
Would it be a custom signature/application that needs to be created?
According to the manual "DNS" is currently not available (in PANOS 5.0) as decoder for custom signatures.
If it were you would be able to create a custom signature that brings you an alert (a log entry) each time a NXDOMAIN answer is seen.
Without the decoder you can still create a custom signature based on the hex-values but then this string must be 7 chars (or something like that) and you will most likely get a bunch of false positives because this string is matched through the whole session and not just in a specific "field".
You can create a Custom Vulnerability Signature to look for the HEX values in a DNS Response header part of a packet that has the No Such Name flag (NXDOMAIN). Below is my custom signature to do just that.
<entry name="And Condition 1">
<entry name="Or Condition 1">
Hope it helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!